CVE-2025-38027 regulator: max20086: fix invalid memory access
A use-after-free vulnerability in the Linux kernel max20086 regulator driver allows attackers to cause a denial of service via invalid memory access during device probing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38027?
CVE-2025-38027 is a high-severity use after free vulnerability in Debian Debian Linux, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
regulator: max20086: fix invalid memory access
max20086_parse_regulators_dt() calls of_regulator_match() using an array of struct of_regulator_match allocated on the stack for the matches argument.
of_regulator_match() calls devm_of_regulator_put_matches(), which calls devres_alloc() to allocate a struct devm_of_regulator_matches which will be de-allocated using devm_of_regulator_put_matches().
struct devm_of_regulator_matches is populated with the stack allocated matches array.
If the device fails to probe, devm_of_regulator_put_matches() will be called and will try to call of_node_put() on that stack pointer, generating the following dmesg entries:
max20086 6-0028: Failed to read DEVICE_ID reg: -121 kobject: '\xc0$\xa5\x03' (000000002cebcb7a): is not initialized, yet kobject_put() is being called.
Followed by a stack trace matching the call flow described above.
Switch to allocating the matches array using devm_kcalloc() to avoid accessing the stack pointer long after it's out of scope.
This also has the advantage of allowing multiple max20086 to probe without overriding the data stored inside the global of_regulator_match.
Weakness: CWE-125
Which versions are affected by CVE-2025-38027?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38027?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-38027 being exploited?
There is no known exploitation of CVE-2025-38027 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2025-38027, DEBIAN-CVE-2025-38027, GHSA-53c4-pm56-gg9x, ROOT-OS-DEBIAN-12-CVE-2025-38027, ROOT-OS-UBUNTU-2404-CVE-2025-38027, UBUNTU-CVE-2025-38027.