GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38446 (GCVE-0-2025-38446)

Vulnerability from cvelistv5 – Published: 2025-07-25 15:27 – Updated: 2026-08-05 12:01
VLAI
Title
clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data
Summary
In the Linux kernel, the following vulnerability has been resolved: clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data When num_parents is 4, __clk_register() occurs an out-of-bounds when accessing parent_names member. Use ARRAY_SIZE() instead of hardcode number here. BUG: KASAN: global-out-of-bounds in __clk_register+0x1844/0x20d8 Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59 Hardware name: NXP i.MX95 19X19 board (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x8c/0xcc print_report+0x398/0x5fc kasan_report+0xd4/0x114 __asan_report_load8_noabort+0x20/0x2c __clk_register+0x1844/0x20d8 clk_hw_register+0x44/0x110 __clk_hw_register_mux+0x284/0x3a8 imx95_bc_probe+0x4f4/0xa70
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5224b189462ff70df328f173b71acfd925092c3c , < fcee75daecc5234ee3482d8cf3518bf021d8a0a5 (git)
Affected: 5224b189462ff70df328f173b71acfd925092c3c , < a956daad67cec454ee985e103e167711fab5b9b8 (git)
Affected: 5224b189462ff70df328f173b71acfd925092c3c , < aacc875a448d363332b9df0621dde6d3a225ea9f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.39 , ≤ 6.12.* (semver)
Unaffected: 6.15.7 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/imx/clk-imx95-blk-ctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fcee75daecc5234ee3482d8cf3518bf021d8a0a5",
              "status": "affected",
              "version": "5224b189462ff70df328f173b71acfd925092c3c",
              "versionType": "git"
            },
            {
              "lessThan": "a956daad67cec454ee985e103e167711fab5b9b8",
              "status": "affected",
              "version": "5224b189462ff70df328f173b71acfd925092c3c",
              "versionType": "git"
            },
            {
              "lessThan": "aacc875a448d363332b9df0621dde6d3a225ea9f",
              "status": "affected",
              "version": "5224b189462ff70df328f173b71acfd925092c3c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/imx/clk-imx95-blk-ctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data\n\nWhen num_parents is 4, __clk_register() occurs an out-of-bounds\nwhen accessing parent_names member. Use ARRAY_SIZE() instead of\nhardcode number here.\n\n BUG: KASAN: global-out-of-bounds in __clk_register+0x1844/0x20d8\n Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59\n  Hardware name: NXP i.MX95 19X19 board (DT)\n  Workqueue: events_unbound deferred_probe_work_func\n  Call trace:\n    dump_backtrace+0x94/0xec\n    show_stack+0x18/0x24\n    dump_stack_lvl+0x8c/0xcc\n    print_report+0x398/0x5fc\n    kasan_report+0xd4/0x114\n    __asan_report_load8_noabort+0x20/0x2c\n    __clk_register+0x1844/0x20d8\n    clk_hw_register+0x44/0x110\n    __clk_hw_register_mux+0x284/0x3a8\n    imx95_bc_probe+0x4f4/0xa70"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The faulty code is reached only through the i.MX95 platform driver probe path driven by the device tree (boot or deferred-probe workqueue), and can be re-triggered locally via module reload or sysfs driver bind; there is no network, adjacent-network, or physical-interface path to it.\nAC:L - The out-of-bounds access is unconditional and deterministic \u2014 every probe of the dispmix CSR block reads `parent_names[3]` past the 3-element array, with no race, timing window, or memory-layout condition involved.\nPR:L - No privileges are needed for the defect to fire, since it executes automatically during driver probe on affected hardware; deliberate re-triggering via bind/unbind or module reload would need local privileges, so at most low privileges are involved.\nUI:N - The out-of-bounds read happens automatically during device probe from the device tree with no victim action required.\nS:U - The out-of-bounds read, the wild dereference, and the corrupted clk parent map are all confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The out-of-bounds pointer is not merely read but handed to `kstrdup_const()`/`kstrdup()`, so an unbounded `strlen()`/copy is performed from an out-of-bounds-derived address and the resulting kernel memory contents are stored as a clk parent name exposed through the clk debugfs interface.\nI:L - The garbage value is persisted into the kernel\u0027s clk parent map, corrupting clock-topology state for a 2-bit mux that can select the bogus index 3; there is no arbitrary-write or control-flow primitive, so the modification is limited.\nA:H - Dereferencing the out-of-bounds value as a string pointer typically faults on an invalid address, producing a kernel oops in the deferred-probe kworker during boot, and even without a fault the display-engine clock is left orphaned and non-functional."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:57.158Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fcee75daecc5234ee3482d8cf3518bf021d8a0a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a956daad67cec454ee985e103e167711fab5b9b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/aacc875a448d363332b9df0621dde6d3a225ea9f"
        }
      ],
      "title": "clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38446",
    "datePublished": "2025-07-25T15:27:28.699Z",
    "dateReserved": "2025-04-16T04:51:24.017Z",
    "dateUpdated": "2026-08-05T12:01:57.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38446",
      "date": "2026-09-16",
      "epss": "0.00152",
      "percentile": "0.04717"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38446\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T16:15:30.100\",\"lastModified\":\"2026-07-30T06:23:14.687\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data\\n\\nWhen num_parents is 4, __clk_register() occurs an out-of-bounds\\nwhen accessing parent_names member. Use ARRAY_SIZE() instead of\\nhardcode number here.\\n\\n BUG: KASAN: global-out-of-bounds in __clk_register+0x1844/0x20d8\\n Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59\\n  Hardware name: NXP i.MX95 19X19 board (DT)\\n  Workqueue: events_unbound deferred_probe_work_func\\n  Call trace:\\n    dump_backtrace+0x94/0xec\\n    show_stack+0x18/0x24\\n    dump_stack_lvl+0x8c/0xcc\\n    print_report+0x398/0x5fc\\n    kasan_report+0xd4/0x114\\n    __asan_report_load8_noabort+0x20/0x2c\\n    __clk_register+0x1844/0x20d8\\n    clk_hw_register+0x44/0x110\\n    __clk_hw_register_mux+0x284/0x3a8\\n    imx95_bc_probe+0x4f4/0xa70\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clk: imx: Se corrige un acceso fuera de los l\u00edmites en dispmix_csr_clk_dev_data. Cuando num_parents es 4, __clk_register() genera un acceso fuera de los l\u00edmites al acceder al miembro parent_names. Use ARRAY_SIZE() en lugar de codificar el n\u00famero. BUG: KASAN: global-out-of-bounds in __clk_register+0x1844/0x20d8 Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59 Hardware name: NXP i.MX95 19X19 board (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x8c/0xcc print_report+0x398/0x5fc kasan_report+0xd4/0x114 __asan_report_load8_noabort+0x20/0x2c __clk_register+0x1844/0x20d8 clk_hw_register+0x44/0x110 __clk_hw_register_mux+0x284/0x3a8 imx95_bc_probe+0x4f4/0xa70\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/clk/imx/clk-imx95-blk-ctl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5224b189462ff70df328f173b71acfd925092c3c\",\"lessThan\":\"fcee75daecc5234ee3482d8cf3518bf021d8a0a5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5224b189462ff70df328f173b71acfd925092c3c\",\"lessThan\":\"a956daad67cec454ee985e103e167711fab5b9b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5224b189462ff70df328f173b71acfd925092c3c\",\"lessThan\":\"aacc875a448d363332b9df0621dde6d3a225ea9f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/clk/imx/clk-imx95-blk-ctl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.39\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.7\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.12.39\",\"matchCriteriaId\":\"5E0A7E52-CDBF-45E4-8338-F679910D5C1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.7\",\"matchCriteriaId\":\"F9C46937-5FA9-4335-AD7B-E7FC29453CE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"85421F4E-C863-4ABF-B4B4-E887CC2F7F92\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a956daad67cec454ee985e103e167711fab5b9b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aacc875a448d363332b9df0621dde6d3a225ea9f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fcee75daecc5234ee3482d8cf3518bf021d8a0a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:29:52+00:00",
      "cve": "CVE-2025-38446",
      "id": "CVE-2025-38446",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38446.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T01:54:46Z",
      "cve": "CVE-2025-38446",
      "id": "CVE-2025-38446",
      "initial_release_date": "2025-07-25T23:22:56Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "524",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38446",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38446.json",
      "version": "24"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.