CVE-2025-38027: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38027 Overview

CVE-2025-38027 is a memory safety vulnerability in the Linux kernel's max20086 regulator driver. The flaw resides in max20086_parse_regulators_dt(), which passes a stack-allocated of_regulator_match array to of_regulator_match(). That callee stores the pointer inside a devres-managed structure that outlives the caller's stack frame. When device probing fails, devm_of_regulator_put_matches() dereferences the now-invalid stack pointer and calls of_node_put() on it, corrupting kernel memory state. The issue is classified as an out-of-bounds read [CWE-125] affecting Linux kernel versions up to 6.15-rc6 and Debian Linux 11.

Critical Impact
Local attackers with low privileges can trigger kernel memory corruption leading to system instability, potential denial of service, and integrity issues in the regulator subsystem.

Affected Products

Linux Kernel (multiple versions including 6.15-rc1 through 6.15-rc6)
Debian Linux 11.0
Systems using the max20086 regulator driver

Discovery Timeline

2025-06-18 - CVE-2025-38027 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38027

Vulnerability Analysis

The vulnerability originates in the Maxim max20086 PMIC (Power Management Integrated Circuit) regulator driver. The function max20086_parse_regulators_dt() declares a struct of_regulator_match array on the stack and passes it to of_regulator_match() for device tree parsing.

Internally, of_regulator_match() invokes devm_of_regulator_put_matches(), which uses devres_alloc() to create a managed devm_of_regulator_matches structure. This structure retains a pointer to the caller's stack-allocated array. The devres framework attaches this allocation to the device lifecycle, not the function scope.

When probing fails, as observed in the reported dmesg trace max20086 6-0028: Failed to read DEVICE_ID reg: -121, the devres cleanup routine executes of_node_put() on the retained pointer. By this point the stack frame has unwound, so the driver dereferences garbage data. The kernel emits kobject: '\\xc0$\\xa5\\x03' is not initialized, yet kobject_put() is being called, confirming corruption of reference-counted kernel objects.

Root Cause

The root cause is a lifetime mismatch between stack-allocated data and device-managed (devres) resources. Storing a pointer to stack memory inside a devres-tracked structure violates the fundamental assumption that devres callbacks run after the caller has returned. A secondary issue is that the global of_regulator_match state could be overwritten when multiple max20086 devices probe concurrently.

Attack Vector

Exploitation requires local access with low privileges on a system running the max20086 driver, typically embedded or automotive Linux platforms. An attacker who can trigger driver probe failures — through hardware manipulation, module reloading, or crafted device tree overlays — causes the kernel to dereference an invalid stack pointer. The result is memory corruption within kernel space, producing system instability and potential denial of service.

The patched implementation replaces the stack allocation with devm_kcalloc(), tying the matches array lifetime to the device rather than the function scope. Refer to the Linux Kernel Patch Details for the complete fix.

Detection Methods for CVE-2025-38027

Indicators of Compromise

Kernel log entries containing max20086 followed by Failed to read DEVICE_ID reg errors
kobject: '...' is not initialized, yet kobject_put() is being called messages in dmesg
Kernel stack traces referencing devm_of_regulator_put_matches or of_regulator_match
Unexpected system instability or panics on platforms using Maxim PMIC regulators

Detection Strategies

Enumerate loaded kernel modules and check for the max20086 driver using lsmod | grep max20086
Verify running kernel versions against the patched commits listed in the vendor advisories
Monitor dmesg and /var/log/kern.log for regulator subsystem errors and kobject warnings
Cross-reference device tree configurations for nodes referencing maxim,max20086

Monitoring Recommendations

Forward kernel logs to a centralized SIEM for correlation of regulator probe failures across fleets
Alert on any recurrence of kobject_put() warnings tied to the regulator subsystem
Track kernel version and patch status inventory for all Linux endpoints and embedded devices
Enable kernel address sanitizer (KASAN) in test environments to surface similar lifetime bugs

How to Mitigate CVE-2025-38027

Immediate Actions Required

Apply the upstream kernel patch that replaces stack allocation with devm_kcalloc() in max20086_parse_regulators_dt()
Update Debian systems to the fixed kernel package per the Debian LTS Announcement
Restrict local access on affected embedded and automotive Linux platforms until patched
Audit systems for the presence of the max20086 driver and prioritize patching those hosts

Patch Information

The fix has been merged into the mainline Linux kernel and backported to stable branches. Relevant commits include d2a9a92bb4cc, 7bddac8603d4, 6ba30f7aa2c5, 6b0cd72757c6, and 5578ab04bd77. Review the Linux Kernel Commit Changes for the primary patch and additional stable-tree backports.

Workarounds

Blacklist the max20086 module on systems that do not require it by adding blacklist max20086 to /etc/modprobe.d/
Remove or disable device tree nodes referencing maxim,max20086 if the hardware is absent
Limit access to physical interfaces and administrative interfaces that could trigger driver reprobing

bash

# Blacklist the max20086 module until the kernel is patched
echo "blacklist max20086" | sudo tee /etc/modprobe.d/blacklist-max20086.conf
sudo update-initramfs -u
# Verify current kernel version against patched releases
uname -r