CVE-2025-38395

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
25/07/2025
Last modified:
25/07/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods<br /> <br /> drvdata::gpiods is supposed to hold an array of &amp;#39;gpio_desc&amp;#39; pointers. But<br /> the memory is allocated for only one pointer. This will lead to<br /> out-of-bounds access later in the code if &amp;#39;config::ngpios&amp;#39; is &gt; 1. So<br /> fix the code to allocate enough memory to hold &amp;#39;config::ngpios&amp;#39; of GPIO<br /> descriptors.<br /> <br /> While at it, also move the check for memory allocation failure to be below<br /> the allocation to make it more readable.

Impact