CVE-2025-38027: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38027 is an invalid memory access vulnerability in the Linux kernel's regulator: max20086 driver, caused by improper use of a stack-allocated array passed to of_regulator_match(). When a device fails to probe, devm_of_regulator_put_matches() attempts to call of_node_put() on a stale stack pointer, resulting in a kernel warning and potential out-of-bounds read. The vulnerability affects Linux kernel versions from 5.17 up to (but not including) 6.1.140, 6.2–6.6.92, 6.7–6.12.30, 6.13–6.14.8, and release candidates 6.15-rc1 through rc6; Debian Linux 11.0 is also listed as affected. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 7.1 (High) (Feedly, Debian LTS).

The root cause is classified as CWE-125 (Out-of-bounds Read). In max20086_parse_regulators_dt(), an array of struct of_regulator_match is allocated on the stack and passed to of_regulator_match(), which internally calls devm_of_regulator_put_matches() to register a devres cleanup handler. This handler stores a pointer to the stack-allocated array in a heap-allocated struct devm_of_regulator_matches. If the device subsequently fails to probe (e.g., due to a failed DEVICE_ID register read returning -121), the devres cleanup fires and attempts to call of_node_put() on the now-invalid stack pointer, producing kernel warnings such as kobject: is not initialized, yet kobject_put() is being called. The fix replaces the stack allocation with devm_kcalloc(), ensuring the array lifetime is managed by the device resource framework (Feedly, Kernel Patch).

Successful triggering of this vulnerability can result in a kernel warning/oops due to access of an invalid (out-of-scope stack) memory address, potentially leading to system instability or a denial of service on affected embedded or industrial systems using the MAX20086 camera power regulator. There is also a confidentiality impact, as the out-of-bounds read may expose kernel stack memory contents. The vulnerability requires local access with low privileges to trigger, limiting its scope to systems where an attacker already has some level of access (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-38027. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and is constrained to systems with the MAX20086 regulator hardware present (Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Users should update to kernel versions 6.1.140 or later, 6.6.92 or later, 6.12.30 or later, or 6.14.8 or later, depending on their branch. Patches are available in the upstream stable kernel repository. Debian LTS users should apply the linux-6.1 security update (DLA-4271-1), and Ubuntu users should apply USN-7699-1 or USN-7699-2. SUSE users should refer to advisories SUSE-2025-02249-1 and SUSE-2025-02538-1 (Kernel Patch, Debian LTS, Ubuntu USN-7699-1).