CVE-2025-38446: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38446 is an out-of-bounds read vulnerability in the Linux kernel's clock (clk) subsystem, specifically in the dispmix_csr_clk_dev_data structure used for NXP i.MX95 platforms. The flaw occurs during clock device registration when num_parents equals 4, causing __clk_register() to perform an out-of-bounds memory access when reading the parent_names array due to a hardcoded size value instead of ARRAY_SIZE(). Affected kernel versions include 6.10 through 6.12.38 (fixed in 6.12.39), 6.13 through 6.15.6 (fixed in 6.15.7), and release candidates 6.16-rc1 through 6.16-rc5 (fixed in 6.16-rc6). The vulnerability was published on July 25, 2025, and carries a CVSS v3.1 base score of 7.1 (High) (Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read). In the dispmix_csr_clk_dev_data structure within the clk-imx driver, the number of parent clock entries was hardcoded rather than computed dynamically using ARRAY_SIZE(). When the actual number of parents is 4, the hardcoded bound is insufficient, causing __clk_register() to read 8 bytes beyond the end of the parent_names global array during the imx95_bc_probe deferred probe workqueue execution. The KASAN report confirms a global-out-of-bounds read at address ffff800086988e78 triggered on NXP i.MX95 19X19 hardware, with the call chain: imx95_bc_probe → __clk_hw_register_mux → clk_hw_register → __clk_register (Feedly). The fix replaces the hardcoded parent count with ARRAY_SIZE() to correctly bound the array access (Kernel Patch).

Successful exploitation by a local low-privileged attacker could result in reading sensitive kernel memory contents (high confidentiality impact) or triggering kernel instability leading to a system crash (high availability impact). The vulnerability has no integrity impact. Because exploitation is limited to local access on systems running NXP i.MX95-based hardware, the attack surface is constrained to embedded or specialized platforms using this SoC (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges on hardware specifically using the NXP i.MX95 SoC, further limiting practical exploitability.

The Linux kernel project has released patches for all affected stable branches: upgrade to kernel 6.12.39 or later for the 6.10–6.12 series, and 6.15.7 or later for the 6.13–6.15 series; the fix is also included in 6.16-rc6 (Kernel Patch, Kernel Patch 2, Kernel Patch 3). Debian (DSA-5975-1) and Ubuntu (USN-7879-1 through USN-7879-4, USN-7880-1, USN-7934-1) have issued updated kernel packages incorporating this fix (Feedly). As an interim measure for systems that cannot be immediately patched, restrict local access to trusted users only and monitor for unexpected kernel panics or KASAN reports.

Debian issued DSA-5975-1 and Ubuntu issued multiple security notices (USN-7879-1 through USN-7879-4, USN-7880-1, USN-7934-1) addressing this vulnerability as part of broader kernel update packages (Feedly). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability, consistent with its limited scope to NXP i.MX95 hardware and low exploitation probability.