CVE-2025-38668: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38668 is a NULL pointer dereference vulnerability in the Linux kernel's regulator core subsystem, caused by stale coupling metadata after device unbind. The flaw arises when coupling_desc.n_coupled is not reset to zero after freeing coupled_rdevs, leaving dangling pointers that can be dereferenced during subsequent regulator operations such as runtime PM. It affects Linux kernel versions from 5.3 up to (but not including) multiple stable branch fix points, as well as Debian Linux 11.0. Published on August 22, 2025, it carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, ENISA EUVD).

The root cause is classified as CWE-476 (NULL Pointer Dereference). When a coupled regulator device is unbound, the kernel frees the coupled_rdevs array but fails to reset coupling_desc.n_coupled to zero. On subsequent regulator operations — such as those triggered by runtime PM — the kernel iterates over n_coupled entries and dereferences now-invalid (freed) pointers. A concrete reproduction path involves unbinding the reg-dummy platform device on ridesx4 hardware, which triggers a kernel panic in regulator_lock_recursive() due to the stale coupling state. The fix ensures n_coupled is explicitly set to 0 after freeing the coupled regulator array (Feedly, ENISA EUVD).

Successful exploitation results in a kernel panic (system crash), causing a complete loss of availability for the affected system. The vulnerability has no confidentiality or integrity impact, as it is a local denial-of-service condition. It is particularly relevant on embedded or SoC platforms (such as ridesx4) that use coupled regulators and perform runtime device binding/unbinding (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-38668. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability requires local access with low privileges (PR:L) to trigger, limiting its attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Fixed versions include: 5.4.297, 5.10.241, 5.15.190, 6.1.148, 6.6.101, 6.12.41, 6.15.9, and 6.16 (mainline). Administrators should update to the appropriate patched kernel version for their distribution. Downstream distributions including Ubuntu (USN-7909-1, USN-7909-3, USN-7910-1, USN-7933-1, USN-7938-1), Oracle Linux, Amazon Linux 2, and openSUSE have issued or are issuing updated kernel packages (Ubuntu Advisory, Amazon Linux, openSUSE Bugzilla).