Security readout for executives and security teams
Plain-English summary
A Linux GPIO regulator driver allocates space for one GPIO pointer even when multiple pointers are required. On systems configured with more than one regulator GPIO, later accesses can exceed the allocation and corrupt kernel memory, potentially affecting confidentiality, integrity, or availability.
Executive priority
Prioritize affected embedded, appliance, and hardware-control systems after confirming multi-GPIO regulator use. Treat confirmed exposure as high priority because kernel memory corruption can have system-wide consequences. Broad emergency action across all Linux systems is not supported without configuration evidence or active exploitation.
Technical view
The gpio-regulator driver underallocates drvdata::gpiods, creating an out-of-bounds access when config::ngpios exceeds one. The published fix sizes the allocation for all GPIO descriptor pointers. CVSS 3.1 is 8.4 with a local attack vector, no privileges, and no user interaction, although vulnerable hardware and configuration appear necessary.
Likely exposure
Exposure is most likely on Linux systems using the GPIO regulator driver with config::ngpios greater than one, particularly hardware-oriented or embedded deployments. Installed kernel version alone is insufficient to establish vulnerability because distributions may backport fixes. The bundled version data is ambiguous and should be checked against vendor advisories and patch status.
Exploitation context
The supplied record does not establish active exploitation, and the CVE is not listed as KEV in the bundle. The local CVSS vector limits direct remote exposure, but successful triggering could corrupt kernel memory with high impact. The exact practical trigger path and exploitability are not documented in the supplied evidence.
Researcher notes
The root cause is allocation of storage for one gpio_desc pointer rather than config::ngpios pointers. Important research questions remain: reachable trigger conditions, affected configuration sources, and whether corruption is reliably controllable. The supplied affected-version presentation lacks clear range semantics, so commit ancestry or distribution backport analysis is preferable to simple version matching.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced stable fix.
- For Debian systems, review the cited LTS advisories and install the applicable security update.
- Prioritize devices using gpio-regulator configurations with more than one GPIO.
- If patching is delayed, consult vendor guidance for supported configuration-level mitigations.
Validation and detection
- Inventory kernel builds and identify systems using the GPIO regulator driver.
- Check regulator configuration for config::ngpios values greater than one.
- Confirm the installed kernel package includes the applicable referenced stable commit or vendor backport.
- Review vendor security advisories because package versions may not match upstream kernel versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38395 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a3cd5ae7befbac849e0e0529c94ca04e8093cfd2CVE reference, Linux
- https://git.kernel.org/stable/c/9fe71972869faed1f8f9b3beb9040f9c1b300c79CVE reference, Linux
- https://git.kernel.org/stable/c/56738cbac3bbb1d39a71a07f57484dec1db8b239CVE reference, Linux
- https://git.kernel.org/stable/c/a1e12fac214d4f49fcb186dbdf9c5592e7fa0a7aCVE reference, Linux
- https://git.kernel.org/stable/c/24418bc77a66cb5be9f5a837431ba3674ed8b52fCVE reference, Linux
- https://git.kernel.org/stable/c/e4d19e5d71b217940e33f2ef6c6962b7b68c5606CVE reference, Linux
- https://git.kernel.org/stable/c/3830ab97cda9599872625cc0dc7b00160193634fCVE reference, Linux
- https://git.kernel.org/stable/c/c9764fd88bc744592b0604ccb6b6fc1a5f76b4e3CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.