CVE-2025-40296 (GCVE-0-2025-40296)
Vulnerability from cvelistv5
Published
2025-12-08 00:46
Modified
2025-12-08 00:46
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: platform/x86: int3472: Fix double free of GPIO device during unregister regulator_unregister() already frees the associated GPIO device. On ThinkPad X9 (Lunar Lake), this causes a double free issue that leads to random failures when other drivers (typically Intel THC) attempt to allocate interrupts. The root cause is that the reference count of the pinctrl_intel_platform module unexpectedly drops to zero when this driver defers its probe. This behavior can also be reproduced by unloading the module directly. Fix the issue by removing the redundant release of the GPIO device during regulator unregistration.
References
Impacted products
Vendor Product Version
Linux Linux Version: 1e5d088a52c207bcef6a43a6f6ffe162c514ed64
Version: 1e5d088a52c207bcef6a43a6f6ffe162c514ed64
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/intel/int3472/clk_and_regulator.c",
            "include/linux/platform_data/x86/int3472.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b8113bb56c45bd17bac5144b55591f9cdbd6aabe",
              "status": "affected",
              "version": "1e5d088a52c207bcef6a43a6f6ffe162c514ed64",
              "versionType": "git"
            },
            {
              "lessThan": "f0f7a3f542c1698edb69075f25a3f846207facba",
              "status": "affected",
              "version": "1e5d088a52c207bcef6a43a6f6ffe162c514ed64",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/intel/int3472/clk_and_regulator.c",
            "include/linux/platform_data/x86/int3472.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: int3472: Fix double free of GPIO device during unregister\n\nregulator_unregister() already frees the associated GPIO device. On\nThinkPad X9 (Lunar Lake), this causes a double free issue that leads to\nrandom failures when other drivers (typically Intel THC) attempt to\nallocate interrupts. The root cause is that the reference count of the\npinctrl_intel_platform module unexpectedly drops to zero when this\ndriver defers its probe.\n\nThis behavior can also be reproduced by unloading the module directly.\n\nFix the issue by removing the redundant release of the GPIO device\nduring regulator unregistration."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-08T00:46:20.017Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b8113bb56c45bd17bac5144b55591f9cdbd6aabe"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0f7a3f542c1698edb69075f25a3f846207facba"
        }
      ],
      "title": "platform/x86: int3472: Fix double free of GPIO device during unregister",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40296",
    "datePublished": "2025-12-08T00:46:20.017Z",
    "dateReserved": "2025-04-16T07:20:57.185Z",
    "dateUpdated": "2025-12-08T00:46:20.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40296\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-08T01:16:01.690\",\"lastModified\":\"2025-12-08T18:26:49.133\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nplatform/x86: int3472: Fix double free of GPIO device during unregister\\n\\nregulator_unregister() already frees the associated GPIO device. On\\nThinkPad X9 (Lunar Lake), this causes a double free issue that leads to\\nrandom failures when other drivers (typically Intel THC) attempt to\\nallocate interrupts. The root cause is that the reference count of the\\npinctrl_intel_platform module unexpectedly drops to zero when this\\ndriver defers its probe.\\n\\nThis behavior can also be reproduced by unloading the module directly.\\n\\nFix the issue by removing the redundant release of the GPIO device\\nduring regulator unregistration.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b8113bb56c45bd17bac5144b55591f9cdbd6aabe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0f7a3f542c1698edb69075f25a3f846207facba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.