UBUNTU-CVE-2025-38446: High severity ubuntu/linux-hwe-edge vulnerability

Q: What systems are most likely to encounter this issue?

The reported failure occurs during clock-driver probing on an NXP i.MX95 board, in the i.MX display-mix clock driver. The affected Ubuntu kernel package list includes linux-riscv, linux-hwe-edge, linux-azure-fde, linux-realtime, linux-aws-5.0, linux-aws-5.3, linux-azure, and linux-azure-5.3.

Q: What access would an attacker need to exploit it?

The supplied severity vector rates the issue as local, with low attack complexity, low privileges required, and no user interaction required. The provided data does not establish a remote attack path.

Q: What is the likely impact if the vulnerable code is triggered?

The vulnerability is an out-of-bounds read in kernel clock registration. The supplied vector rates confidentiality and availability impact as high, while integrity impact is rated none.

Q: How can I identify whether the affected path has been hit?

Kernel logs may contain a KASAN global-out-of-bounds report in __clk_register, with call frames including clk_hw_register, __clk_hw_register_mux, and imx95_bc_probe. The example report occurred from deferred_probe_work_func on an NXP i.MX95 device.

Published Jul 25, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: clk: imx: Fix an out-of-bounds access in dispmixcsrclkdevdata When numparents is 4, clkregister() occurs an out-of-bounds when accessing parentnames member. Use ARRAYSIZE() instead of hardcode number here. BUG: KASAN: global-out-of-bounds in clkregister+0x1844/0x20d8 Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59 Hardware name: NXP i.MX95 19X19 board (DT) Workqueue: eventsunbound deferredprobeworkfunc Call trace: dumpbacktrace+0x94/0xec showstack+0x18/0x24 dumpstacklvl+0x8c/0xcc printreport+0x398/0x5fc kasanreport+0xd4/0x114 asanreportload8noabort+0x20/0x2c clkregister+0x1844/0x20d8 clkhwregister+0x44/0x110 clkhwregistermux+0x284/0x3a8 imx95bcprobe+0x4f4/0xa70

Affected Software

97 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1020.21~24.04.1

6.14.0-1020.21~24.04.1

ubuntu/linux-hwe-6.11*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14<6.14.0-1016.16

6.14.0-1016.16

ubuntu/linux-oracle-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14<6.14.0-36.36.1~24.04.1

6.14.0-36.36.1~24.04.1

ubuntu/linux-realtime-6.14<6.14.0-1016.16~24.04.1

6.14.0-1016.16~24.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1020.21~24.04.1
Upgrade
Upgrade ubuntu/linux-oem-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16
Upgrade
Upgrade ubuntu/linux-oracle-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-36.36.1~24.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16~24.04.1
Compensating control
In dispmix_csr_clk_dev_data, use ARRAY_SIZE() instead of a hardcoded parent count when setting num_parents, preventing __clk_register() from accessing parent_names out of bounds.

Event History

Jul 25, 2025

CVE Published

via OSV·04:15 PM

Data Sourced

via OSV·04:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What systems are most likely to encounter this issue?

The reported failure occurs during clock-driver probing on an NXP i.MX95 board, in the i.MX display-mix clock driver. The affected Ubuntu kernel package list includes linux-riscv, linux-hwe-edge, linux-azure-fde, linux-realtime, linux-aws-5.0, linux-aws-5.3, linux-azure, and linux-azure-5.3.

What access would an attacker need to exploit it?

The supplied severity vector rates the issue as local, with low attack complexity, low privileges required, and no user interaction required. The provided data does not establish a remote attack path.

What is the likely impact if the vulnerable code is triggered?

The vulnerability is an out-of-bounds read in kernel clock registration. The supplied vector rates confidentiality and availability impact as high, while integrity impact is rated none.

How can I identify whether the affected path has been hit?

Kernel logs may contain a KASAN global-out-of-bounds report in __clk_register, with call frames including clk_hw_register, __clk_hw_register_mux, and imx95_bc_probe. The example report occurred from deferred_probe_work_func on an NXP i.MX95 device.

UBUNTU-CVE-2025-38446: High severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What systems are most likely to encounter this issue?

What access would an attacker need to exploit it?

What is the likely impact if the vulnerable code is triggered?

How can I identify whether the affected path has been hit?

Company

Resources

Contact

Frequently Asked Questions

What systems are most likely to encounter this issue?

What access would an attacker need to exploit it?

What is the likely impact if the vulnerable code is triggered?

How can I identify whether the affected path has been hit?