LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data

In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix NULL dereference on unbind due to stale coupling data Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can lead to NULL pointer dereference when regulators are accessed post-unbind. This can happen during runtime PM or other regulator operations that rely on coupling metadata. For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers a panic in regulator_lock_recursive() due to stale coupling state. Ensure n_coupled is set to 0 to prevent access to invalid pointers.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw can crash an affected system when regulator cleanup leaves stale coupling metadata behind. It is primarily an availability risk: systems using the affected regulator paths may panic during device unbind or related power-management activity.

Executive priority

Treat as a scheduled kernel reliability update, not an emergency remote-compromise event based on current sources. Prioritize systems where kernel panics would affect production availability or embedded device uptime.

Technical view

The regulator core may free coupled_rdevs without resetting coupling_desc.n_coupled. Later regulator operations can treat the stale count as valid and dereference invalid or NULL coupling data, causing a kernel panic such as in regulator_lock_recursive().

Likely exposure

Exposure appears limited to Linux kernels with the affected regulator core behavior and platforms or drivers using coupled regulators, device unbind, or runtime PM paths. The bundle lists Linux kernel versions and stable commits, but does not provide distribution-specific affected package ranges beyond Debian advisory references.

Exploitation context

The sources do not show active exploitation, and KEV is false. The provided example is a panic after unbinding the reg-dummy platform device on ridesx4. No remote attack path or public exploit details are provided.

Researcher notes

The key issue is stale coupling state after freeing coupled_rdevs. The fix direction is to reset n_coupled to zero so later regulator operations do not traverse invalid coupling metadata.

Mitigation direction

  • Update to a Linux kernel containing the referenced stable fixes.
  • Apply relevant distribution kernel updates, including Debian LTS guidance where applicable.
  • Avoid unnecessary regulator device unbind operations on vulnerable systems until patched.
  • Check vendor or distribution advisories for exact package-level fixed versions.

Validation and detection

  • Inventory systems running Linux kernels in the affected version range.
  • Confirm whether deployed kernels include one of the referenced regulator core fix commits.
  • Review crash logs for regulator_lock_recursive or regulator unbind panic indicators.
  • Check whether platforms use coupled regulators or runtime PM paths affected by this bug.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38668 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
11Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd8ca7d184b33af7913c244900df77c6cad6a5590, d8ca7d184b33af7913c244900df77c6cad6a5590, d8ca7d184b33af7913c244900df77c6cad6a5590, d8ca7d184b33af7913c244900df77c6cad6a5590, d8ca7d184b33af7913c244900df77c6cad6a5590, d8ca7d184b33af7913c244900df77c6cad6a5590, d8ca7d184b33af7913c244900df77c6cad6a5590, d8ca7d184b33af7913c244900df77c6cad6a5590unaffected
LinuxLinux5.3, 0, 5.4.297, 5.10.241, 5.15.190, 6.1.148, 6.6.101, 6.12.41, 6.15.9, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.