CVE-2025-38027

Estado: AnalizadaAlta (7.1)—

In the Linux kernel, the following vulnerability has been resolved:

regulator: max20086: fix invalid memory access

max20086_parse_regulators_dt() calls of_regulator_match() using an array of struct of_regulator_match allocated on the stack for the matches argument.

of_regulator_match() calls devm_of_regulator_put_matches(), which calls devres_alloc() to allocate a struct devm_of_regulator_matches which will be de-allocated using devm_of_regulator_put_matches().

struct devm_of_regulator_matches is populated with the stack allocated matches array.

If the device fails to probe, devm_of_regulator_put_matches() will be called and will try to call of_node_put() on that stack pointer, generating the following dmesg entries:

Leer descripción completaMostrar menos

max20086 6-0028: Failed to read DEVICE_ID reg: -121 kobject: '\xc0$\xa5\x03' (000000002cebcb7a): is not initialized, yet kobject_put() is being called.

Followed by a stack trace matching the call flow described above.

Switch to allocating the matches array using devm_kcalloc() to avoid accessing the stack pointer long after it's out of scope.

This also has the advantage of allowing multiple max20086 to probe without overriding the data stored inside the global of_regulator_match.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Puntuación base: 7.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.20%
Percentil entre todas las CVEs puntuadas: 9
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation65 %
Impacto principalT1059 Command and Scripting Interpreterexecution45 %

Acceso local (AV:L) sin interacción (UI:N) con privilegios (PR:L) permite escalada mediante acceso a memoria inválida. El uso de devm_kcalloc() sugiere impacto en ejecución de código, aunque no es explícitamente explotable en el contexto descrito.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Behavior Prevention on Endpoint

Tecnologías afectadas (2)

Debian — Debian Linux Linux — Linux Kernel

CWE

CWE-125

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-38027",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "bfff546aae50ae68ed395bf0e0848188d27b0ba3",
              "lessThan": "6ba30f7aa2c550b2ac04f16b81a19a8c045b8660",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bfff546aae50ae68ed395bf0e0848188d27b0ba3",
              "lessThan": "7bddac8603d4e396872c2fbf4403ec08e7b1d7c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bfff546aae50ae68ed395bf0e0848188d27b0ba3",
              "lessThan": "d2a9a92bb4cc7568cff68241b0051dc7268bdc68",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bfff546aae50ae68ed395bf0e0848188d27b0ba3",
              "lessThan": "5578ab04bd7732f470fc614bbc0a924900399fb8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bfff546aae50ae68ed395bf0e0848188d27b0ba3",
              "lessThan": "6b0cd72757c69bc2d45da42b41023e288d02e772",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/regulator/max20086-regulator.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.140",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.92",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.30",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.14.8",
              "versionType": "semver",
              "lessThanOrEqual": "6.14.*"
            },
            {
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/regulator/max20086-regulator.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-06-18T10:15:34.720",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/5578ab04bd7732f470fc614bbc0a924900399fb8",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6b0cd72757c69bc2d45da42b41023e288d02e772",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6ba30f7aa2c550b2ac04f16b81a19a8c045b8660",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7bddac8603d4e396872c2fbf4403ec08e7b1d7c8",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d2a9a92bb4cc7568cff68241b0051dc7268bdc68",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: max20086: fix invalid memory access\n\nmax20086_parse_regulators_dt() calls of_regulator_match() using an\narray of struct of_regulator_match allocated on the stack for the\nmatches argument.\n\nof_regulator_match() calls devm_of_regulator_put_matches(), which calls\ndevres_alloc() to allocate a struct devm_of_regulator_matches which will\nbe de-allocated using devm_of_regulator_put_matches().\n\nstruct devm_of_regulator_matches is populated with the stack allocated\nmatches array.\n\nIf the device fails to probe, devm_of_regulator_put_matches() will be\ncalled and will try to call of_node_put() on that stack pointer,\ngenerating the following dmesg entries:\n\nmax20086 6-0028: Failed to read DEVICE_ID reg: -121\nkobject: '\\xc0$\\xa5\\x03' (000000002cebcb7a): is not initialized, yet\nkobject_put() is being called.\n\nFollowed by a stack trace matching the call flow described above.\n\nSwitch to allocating the matches array using devm_kcalloc() to\navoid accessing the stack pointer long after it's out of scope.\n\nThis also has the advantage of allowing multiple max20086 to probe\nwithout overriding the data stored inside the global of_regulator_match."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: regulator: max20086: corrige acceso de memoria no válido max20086_parse_regulators_dt() llama a of_regulator_match() utilizando una matriz de struct of_regulator_match asignada en la pila para el argumento matches. of_regulator_match() llama a devm_of_regulator_put_matches(), que llama a devres_alloc() para asignar un struct devm_of_regulator_matches que se desasignará utilizando devm_of_regulator_put_matches(). struct devm_of_regulator_matches se rellena con la matriz matches asignada a la pila. Si el dispositivo no realiza el sondeo, se llamará a devm_of_regulator_put_matches() e intentará llamar a of_node_put() en ese puntero de pila, lo que generará las siguientes entradas dmesg: max20086 6-0028: Failed to read DEVICE_ID reg: -121 kobject: '\\xc0$\\xa5\\x03' (000000002cebcb7a): no se ha inicializado, pero se está llamando a kobject_put(). Seguido de un seguimiento de la pila que coincide con el flujo de llamada descrito anteriormente. Cambie a la asignación de la matriz de coincidencias mediante devm_kcalloc() para evitar acceder al puntero de pila mucho después de que esté fuera del alcance. Esto también tiene la ventaja de permitir que varios max20086 realicen el sondeo sin sobrescribir los datos almacenados dentro del global of_regulator_match."
    }
  ],
  "lastModified": "2026-06-17T09:15:54.530",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1EE8C4C5-9D98-4469-A055-9DD3E67DF0FD",
              "versionEndExcluding": "6.1.140",
              "versionStartIncluding": "5.17"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7787FD66-D748-44AF-A052-DE495E1E23AE",
              "versionEndExcluding": "6.6.92",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F43EF2E-9448-4BCA-99D9-DAEAEB7523C5",
              "versionEndExcluding": "6.12.30",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4458049-AD51-4F1B-BAB9-C32B53A54DE1",
              "versionEndExcluding": "6.14.8",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}