CVE-2025-38395

regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods

published July 25, 2025

CVSS
—
EPSS
0%
Percentile
8.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods

drvdata::gpiods is supposed to hold an array of 'gpio_desc' pointers. But

the memory is allocated for only one pointer. This will lead to

out-of-bounds access later in the code if 'config::ngpios' is > 1. So

fix the code to allocate enough memory to hold 'config::ngpios' of GPIO

descriptors.

While at it, also move the check for memory allocation failure to be below

the allocation to make it more readable.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00195 · 8.7th percentile
Published
2025-07-25T12:53Z
EPSS history
Timeline
  • 25 JUL 12:53Z
    regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
    cvelistv5