CVE-2025-38446: clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data
In the Linux kernel, the following vulnerability has been resolved:
clk: imx: Fix an out-of-bounds access in dispmixcsrclkdevdata
When numparents is 4, clkregister() occurs an out-of-bounds when accessing parentnames member. Use ARRAYSIZE() instead of hardcode number here.
BUG: KASAN: global-out-of-bounds in clkregister+0x1844/0x20d8 Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59 Hardware name: NXP i.MX95 19X19 board (DT) Workqueue: eventsunbound deferredprobeworkfunc Call trace: dumpbacktrace+0x94/0xec showstack+0x18/0x24 dumpstacklvl+0x8c/0xcc printreport+0x398/0x5fc kasanreport+0xd4/0x114 asanreportload8noabort+0x20/0x2c clkregister+0x1844/0x20d8 clkhwregister+0x44/0x110 clkhwregistermux+0x284/0x3a8 imx95bcprobe+0x4f4/0xa70
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In clk/imx, update dispmix_csr_clk_dev_data to use ARRAY_SIZE() instead of a hardcoded parent count, preventing the out-of-bounds access when num_parents is 4.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38446?
CVE-2025-38446 has a low severity rating due to its specific exposure in the Linux kernel.
How do I fix CVE-2025-38446?
To fix CVE-2025-38446, update the Linux kernel to the latest stable version that includes the security patch.
Which versions of the Linux kernel are affected by CVE-2025-38446?
CVE-2025-38446 affects specific versions of the Linux kernel that have not incorporated the relevant fix.
What are the implications of CVE-2025-38446?
The implications of CVE-2025-38446 include potential out-of-bounds access which could lead to a system crash or unexpected behavior.
Is CVE-2025-38446 exploitable remotely?
CVE-2025-38446 is not typically exploitable remotely as it requires local access to the affected kernel.