CVE-2025-38631: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38631 is a denial-of-service vulnerability in the Linux kernel's clk: imx95-blk-ctl clock management subsystem that causes a synchronous external abort (kernel crash) when enabling runtime Power Management (PM) for clock suppliers that also belong to a power domain. It affects Linux kernel versions 6.10 through 6.12.41, 6.13 through 6.15.9, and 6.16 through 6.16.0. The vulnerability was published on August 22, 2025, with patches backported to stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is improper runtime PM lifecycle management in the imx95_bc_probe() function of the IMX95 block control driver (CWE-400: Uncontrolled Resource Consumption / improper state management). When pm_runtime_enable() is called without explicitly resuming the device, the associated power domain is cut off after clk_register() completes. Subsequently, when of_clk_add_hw_provider() is called and attempts to read the BLK_CTL register to determine clock mux parents via clk_mux_get_parent(), the hardware is powered down, triggering a synchronous external abort (0000000096000010). The fix replaces pm_runtime_enable() with devm_pm_runtime_enable() and removes the redundant pm_runtime_disable() call from the cleanup path (Red Hat Advisory, Kernel Patch).

Successful exploitation causes a kernel panic (synchronous external abort) on systems using the i.MX95 SoC with the affected clock block control driver, resulting in a complete denial of service (system crash). The impact is limited to availability — there is no confidentiality or integrity impact. The crash occurs during device probing (deferred probe workqueue), meaning it can be triggered at boot or during device hotplug events on affected hardware (Feedly, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability requires local access with low privileges (e.g., ability to trigger device probing on an i.MX95-based system) and is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (Feedly).

Update to a patched Linux kernel version: 6.12.42 or later (for the 6.10–6.12 branch), 6.15.10 or later (for the 6.13–6.15 branch), or 6.16.1 or later (for the 6.16 branch). The fix is also included in 6.17-rc1. No configuration-based workaround is available; the only remediation is applying the upstream kernel patches. Systems not using i.MX95-based hardware are not affected (Kernel Patch, Red Hat Advisory).

Red Hat has published a security advisory tracking this CVE. No significant researcher commentary, social media discussion, or broader media coverage has been identified for this vulnerability, consistent with its narrow hardware scope and medium severity rating (Red Hat Advisory).