CVE-2025-68354: regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
In the Linux kernel, the following vulnerability has been resolved:
regulator: core: Protect regulatorsupplyaliaslist with regulatorlistmutex
regulatorsupplyaliaslist was accessed without any locking in regulatorsupplyalias(), regulatorregistersupplyalias(), and regulatorunregistersupplyalias(). Concurrent registration, unregistration and lookups can race, leading to:
1 use-after-free if an alias entry is removed while being read, 2 duplicate entries when two threads register the same alias, 3 inconsistent alias mappings observed by consumers.
Protect all traversals, insertions and deletions on regulatorsupplyaliaslist with the existing regulatorlistmutex.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Protect all traversals, insertions, deletions, registrations, unregistrations, and lookups of regulator_supply_alias_list with the existing regulator_list_mutex.
Linux kernel regulator core regulator_supply_alias_list synchronization = regulator_list_mutex
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68354?
CVE-2025-68354 has been rated as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-68354?
To fix CVE-2025-68354, update your Linux kernel to the latest version where the vulnerability has been patched.
What is the impact of CVE-2025-68354?
CVE-2025-68354 may allow local users to exploit race conditions leading to arbitrary read or write access.
Which versions of Linux kernel are affected by CVE-2025-68354?
CVE-2025-68354 affects Linux kernel versions before the release of the patch that addresses the vulnerability.
Is CVE-2025-68354 exploitable remotely?
CVE-2025-68354 is primarily a local vulnerability and does not have a known remote exploitation vector.