https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:50:36 +0000 https://vulnerability.circl.lu/vuln/cve-2025-38027 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>regulator: max20086: fix invalid memory access</p> <p>max20086_parse_regulators_dt() calls of_regulator_match() using an array of struct of_regulator_match allocated on the stack for the matches argument.</p> <p>of_regulator_match() calls devm_of_regulator_put_matches(), which calls devres_alloc() to allocate a struct devm_of_regulator_matches which will be de-allocated using devm_of_regulator_put_matches().</p> <p>struct devm_of_regulator_matches is populated with the stack allocated matches array.</p> <p>If the device fails to probe, devm_of_regulator_put_matches() will be called and will try to call of_node_put() on that stack pointer, generating the following dmesg entries:</p> <p>max20086 6-0028: Failed to read DEVICE_ID reg: -121 kobject: &#39;\xc0$\xa5\x03&#39; (000000002cebcb7a): is not initialized, yet kobject_put() is being called.</p> <p>Followed by a stack trace matching the call flow described above.</p> <p>Switch to allocating the matches array using devm_kcalloc() to avoid accessing the stack pointer long after it&#39;s out of scope.</p> <p>This also has the advantage of allowing multiple max20086 to probe without overriding the data stored inside the global of_regulator_match.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>regulator: max20086: fix invalid memory access</p> <p>max20086_parse_regulators_dt() calls of_regulator_match() using an array of struct of_regulator_match allocated on the stack for the matches argument.</p> <p>of_regulator_match() calls devm_of_regulator_put_matches(), which calls devres_alloc() to allocate a struct devm_of_regulator_matches which will be de-allocated using devm_of_regulator_put_matches().</p> <p>struct devm_of_regulator_matches is populated with the stack allocated matches array.</p> <p>If the device fails to probe, devm_of_regulator_put_matches() will be called and will try to call of_node_put() on that stack pointer, generating the following dmesg entries:</p> <p>max20086 6-0028: Failed to read DEVICE_ID reg: -121 kobject: &#39;\xc0$\xa5\x03&#39; (000000002cebcb7a): is not initialized, yet kobject_put() is being called.</p> <p>Followed by a stack trace matching the call flow described above.</p> <p>Switch to allocating the matches array using devm_kcalloc() to avoid accessing the stack pointer long after it&#39;s out of scope.</p> <p>This also has the advantage of allowing multiple max20086 to probe without overriding the data stored inside the global of_regulator_match.</p> https://vulnerability.circl.lu/vuln/cve-2025-38027