CVE-2025-40296: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40296 is a double-free vulnerability in the Linux kernel's platform/x86: int3472 driver, affecting GPIO device handling during regulator unregistration. The flaw was disclosed on December 8, 2025, and affects Linux kernel versions prior to the patches introduced in 6.17.8 and 6.18. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring only local access with low privileges to exploit (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a double-free memory corruption bug (CWE-415) in the int3472 platform driver. When regulator_unregister() is called, it already frees the associated GPIO device; however, the driver also performs a redundant release of the same GPIO device, resulting in a double free. On ThinkPad X9 (Lunar Lake) hardware, this causes the reference count of the pinctrl_intel_platform module to unexpectedly drop to zero during probe deferral, leading to random failures when other drivers (such as Intel THC) attempt to allocate interrupts. The issue can also be triggered by directly unloading the affected kernel module. The fix removes the redundant GPIO device release during regulator unregistration (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation causes denial of service through system instability and random failures, particularly on ThinkPad X9 (Lunar Lake) devices. The double-free condition corrupts kernel memory, which can prevent other drivers (notably Intel THC) from successfully allocating interrupts, leading to unpredictable system behavior. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat Advisory).

The fix has been merged into the Linux kernel stable tree, with patches available for kernel versions 6.17.8 and 6.18 (commits b8113bb56c45 and f0f7a3f542c1). Users should update to a patched kernel version as the primary remediation. As a temporary workaround, avoid unloading the int3472 module directly on affected hardware (ThinkPad X9 / Lunar Lake). Monitoring system stability and interrupt allocation failures on affected devices is also recommended (Red Hat Bugzilla, Red Hat Advisory).