Skip to main content

Linux Kernel CVE-2025-38446

HIGH
Out-of-bounds Read (CWE-125)
2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
5.3 MEDIUM

Triggers automatically at boot-time probe on specific i.MX95 hardware (AV:L, AC:H); reads an internal pointer with limited disclosure (C:L) but can crash the clk subsystem (A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:20 vuln.today
CVE Published
Jul 25, 2025 - 16:15 nvd
HIGH 7.1

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data

When num_parents is 4, __clk_register() occurs an out-of-bounds when accessing parent_names member. Use ARRAY_SIZE() instead of hardcode number here.

BUG: KASAN: global-out-of-bounds in __clk_register+0x1844/0x20d8 Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59 Hardware name: NXP i.MX95 19X19 board (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x8c/0xcc print_report+0x398/0x5fc kasan_report+0xd4/0x114 __asan_report_load8_noabort+0x20/0x2c __clk_register+0x1844/0x20d8 clk_hw_register+0x44/0x110 __clk_hw_register_mux+0x284/0x3a8 imx95_bc_probe+0x4f4/0xa70

AnalysisAI

Out-of-bounds memory access in the Linux kernel's NXP i.MX clock driver (clk-imx) affects 6.16 release candidates rc1 through rc5 running on i.MX95 hardware, where the dispmix_csr_clk_dev_data table uses a hardcoded parent-name count that overruns the parent_names array when num_parents is 4. Triggered automatically during device probe (imx95_bc_probe → __clk_register), it reads eight bytes past a global array, causing memory disclosure into pointer handling and potential kernel instability, as caught by KASAN. There is no public exploit identified at time of analysis and EPSS is negligible (0.15%, 5th percentile), consistent with a hardware- and pre-release-specific defect rather than a broadly exploitable flaw.

Technical ContextAI

The affected code is the Common Clock Framework (CCF) support for NXP i.MX95 SoCs, specifically the display-mix / block-control (blk-ctl) clock provider. During probe, __clk_hw_register_mux registers a multiplexer clock and __clk_register iterates over parent_names using a count value. The driver hardcoded the number of parents instead of deriving it from the actual array size, so when a mux legitimately has 4 parents the loop reads one element beyond the statically-allocated parent_names[] global, producing a KASAN global-out-of-bounds read of size 8 (a pointer). This is a classic CWE-125 (Out-of-bounds Read) rooted in a length/array-size mismatch; the fix replaces the hardcoded constant with ARRAY_SIZE() so the count always matches the declared array.

RemediationAI

Patch available per vendor: apply the upstream kernel fix that replaces the hardcoded parent count with ARRAY_SIZE() in dispmix_csr_clk_dev_data, available as kernel.org commits https://git.kernel.org/stable/c/a956daad67cec454ee985e103e167711fab5b9b8, https://git.kernel.org/stable/c/aacc875a448d363332b9df0621dde6d3a225ea9f, and https://git.kernel.org/stable/c/fcee75daecc5234ee3482d8cf3518bf021d8a0a5; update to a 6.16 release candidate or GA build that includes these commits. Because the fix landed within the 6.16-rc cycle, moving to the final 6.16 release (or later) resolves it. If immediate rebuild is not possible on affected i.MX95 systems, a compensating control is to avoid deploying the vulnerable 6.16-rc kernels in production and to disable or not load the i.MX95 blk-ctl/dispmix clock provider if the platform can function without it - with the trade-off that display-mix and dependent peripheral clocks may be unavailable, which is generally impractical on boards that need those clocks, so upgrading is strongly preferred over disabling.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

Share

CVE-2025-38446 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy