CVE-2025-68222: pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: s32cc: fix uninitialized memory in s32pinctrldesc
s32pinctrldesc is allocated with devmkmalloc(), but not all of its fields are initialized. Notably, numcustomparams is used in pinconfgenericparsedtconfig(), resulting in intermittent allocation errors, such as the following splat when probing i2c-imx:
WARNING: CPU: 0 PID: 176 at mm/pagealloc.c:4795 allocpagesnoprof+0x290/0x300 [...] Hardware name: NXP S32G3 Reference Design Board 3 (S32G-VNP-RDB3) (DT) [...] Call trace: allocpagesnoprof+0x290/0x300 (P) kmalloclargenode+0x84/0x168 kmalloclargenodenoprof+0x34/0x120 kmallocnoprof+0x2ac/0x378 pinconfgenericparsedtconfig+0x68/0x1a0 s32dtnodetomap+0x104/0x248 dttomaponeconfig+0x154/0x1d8 pinctrldttomap+0x12c/0x280 createpinctrl+0x6c/0x270 pinctrlget+0xc0/0x170 devmpinctrlget+0x50/0xa0 pinctrlbindpins+0x60/0x2a0 reallyprobe+0x60/0x3a0 [...] platformdriverregister+0x2c/0x40 i2cadapimxinit+0x28/0xff8 [i2cimx] [...]
This results in later parse failures that can cause issues in dependent drivers:
s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property [...] pca953x 0-0022: failed writing register: -6 i2c i2c-0: IMX I2C adapter registered s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property i2c i2c-1: IMX I2C adapter registered s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property i2c i2c-2: IMX I2C adapter registered
Fix this by initializing s32pinctrldesc with devmkzalloc() instead of devmkmalloc() in s32pinctrlprobe(), which sets the previously uninitialized fields to zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel s32 pinctrl driver, change the allocation of s32_pinctrl_desc in s32_pinctrl_probe() from devm_kmalloc() to devm_kzalloc() so all descriptor fields are initialized to zero.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68222?
CVE-2025-68222 has been assigned a low severity rating due to its nature of involving uninitialized memory in a non-critical area.
How do I fix CVE-2025-68222?
To fix CVE-2025-68222, ensure you apply the latest patches or updates provided by your Linux distribution.
What is the impact of CVE-2025-68222 on my system?
The impact of CVE-2025-68222 may include potential information leaks due to the use of uninitialized memory.
Which Linux kernel versions are affected by CVE-2025-68222?
CVE-2025-68222 affects versions of the Linux kernel where s32_pinctrl_desc is implemented without proper memory initialization.
What components are involved in CVE-2025-68222?
CVE-2025-68222 specifically involves the pin control subsystem in the Linux kernel.