CVE-2025-38423: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38423 is a vulnerability discovered in the Linux kernel, specifically affecting the ASoC (ALSA System on Chip) codec wcd9375. The issue was publicly disclosed on July 25, 2025, and involves a double free vulnerability in the regulator supplies functionality (NVD, Red Hat).

The vulnerability occurs in the probe path where the driver gets regulator supplies using devm_regulator_bulk_get(). The issue arises when regulator_bulk_free() is incorrectly called in error and remove paths, leading to a potential double free condition. The vulnerability has been assigned a CVSS 3.1 base score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a moderate severity level (Red Hat XML).

The vulnerability primarily affects system availability, as indicated by the CVSS metrics showing high impact on availability (A:H) but no impact on confidentiality (C:N) or integrity (I:N). The local nature of the vulnerability (AV:L) somewhat limits its potential impact (Red Hat XML).

The vulnerability has been resolved in the Linux kernel through a patch that removes the incorrect calls to regulator_bulk_free() in error and remove paths. Red Hat Enterprise Linux versions 6 through 10, including RT kernels, are not affected by this vulnerability (Red Hat XML).