LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38446: clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data

In the Linux kernel, the following vulnerability has been resolved: clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data When num_parents is 4, __clk_register() occurs an out-of-bounds when accessing parent_names member. Use ARRAY_SIZE() instead of hardcode number here. BUG: KASAN: global-out-of-bounds in __clk_register+0x1844/0x20d8 Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59 Hardware name: NXP i.MX95 19X19 board (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x8c/0xcc print_report+0x398/0x5fc kasan_report+0xd4/0x114 __asan_report_load8_noabort+0x20/0x2c __clk_register+0x1844/0x20d8 clk_hw_register+0x44/0x110 __clk_hw_register_mux+0x284/0x3a8 imx95_bc_probe+0x4f4/0xa70

HighCVSS 7.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel clock-driver flaw can read beyond a fixed data structure while initializing display-related clocks, potentially crashing or exposing kernel memory. The supplied trace involves an NXP i.MX95 board, so risk appears concentrated in systems using that hardware path rather than all Linux systems.

Executive priority

Treat this as a high-priority, hardware-targeted kernel update. Accelerate assessment for exposed i.MX95 production systems, especially safety-sensitive or high-availability devices. Broader Linux fleets should first confirm whether the relevant driver and hardware path are present.

Technical view

The i.MX display-mix clock data declared four parents while its parent-name array was smaller. During deferred device probing, __clk_register() read eight bytes beyond global memory. The published correction replaces a hard-coded parent count with ARRAY_SIZE(), aligning registration with the actual array length.

Likely exposure

Prioritize Linux devices using the affected i.MX clock-driver path, particularly NXP i.MX95 systems. The bundle lists affected kernel versions including 6.10, 6.12.39, 6.15.7, and 6.16, but its version metadata is ambiguous. Confirm exposure through fix-commit or vendor-package status.

Exploitation context

The supplied CVSS vector describes local access with low privileges, no user interaction, and potentially high confidentiality and availability impact. However, the sources provide no exploitation mechanism, public exploit evidence, or active-exploitation report. This CVE is not identified as being in KEV.

Researcher notes

The observed fault is an eight-byte global out-of-bounds read during clock registration. KASAN demonstrates memory-safety impact, but the bundle does not establish attacker-controlled indexing or practical data disclosure. Because the affected-version encoding is incomplete or ambiguous, commit-level verification is more reliable than version-only matching.

Mitigation direction

  • Obtain a vendor-supported kernel containing the referenced upstream correction.
  • Compare deployed kernel sources or package changelogs against the three referenced fix commits.
  • Prioritize affected i.MX95 appliances where kernel crashes or information exposure carry operational consequences.
  • If updating is delayed, seek platform-vendor guidance for supported temporary mitigations.

Validation and detection

  • Inventory Linux devices using NXP i.MX95 or the relevant display-mix clock path.
  • Record exact kernel package, vendor build, and source revision for each candidate system.
  • Verify whether the deployed build contains an applicable referenced correction.
  • Review kernel and KASAN logs for global out-of-bounds reports involving __clk_register or imx95_bc_probe.
  • Test updated kernels through normal boot and deferred device-probe workflows.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38446 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.3CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.3High
CVSS 3.1 vector shape for CVE-2025-38446Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5224b189462ff70df328f173b71acfd925092c3c, 5224b189462ff70df328f173b71acfd925092c3c, 5224b189462ff70df328f173b71acfd925092c3cunaffected
LinuxLinux6.10, 0, 6.12.39, 6.15.7, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.