CVE-2025-38286 Overview
CVE-2025-38286 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's pinctrl-at91 driver. The flaw resides in the at91_gpio_probe() function, which fails to validate the return value when retrieving an Open Firmware (OF) alias. When the alias is unavailable or the retrieval fails, the returned index value can be used to access the gpio_chips array without bounds checking. The existing BUG() macro is insufficient because it can be compiled out, leaving the boundary check absent in production builds. The vulnerability affects Linux kernel builds targeting Atmel AT91 SoC platforms and has been addressed across multiple stable kernel branches.
Critical Impact
A local authenticated attacker can trigger out-of-bounds memory access in the kernel's pinctrl subsystem, resulting in high impact to confidentiality and availability on affected AT91-based Linux systems.
Affected Products
- Linux Kernel (multiple stable branches prior to the referenced fix commits)
- Debian Linux 11.0
- Systems using the Atmel AT91 SoC pinctrl-at91 driver
Discovery Timeline
- 2025-07-10 - CVE-2025-38286 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-38286
Vulnerability Analysis
The vulnerability exists in the at91_gpio_probe() function within the pinctrl-at91 driver. During probe, the driver retrieves an Open Firmware alias to determine an index into the gpio_chips array. The function does not verify whether the alias lookup succeeded or returned a valid, in-range value. When the alias is missing or the retrieval fails, an unchecked index is passed to array access logic. This produces an out-of-bounds read against the gpio_chips structure.
The original code relied on BUG() to catch invalid states. Kernel build configurations can disable BUG(), which removes the assertion entirely. Without the assertion, the driver proceeds with an invalid index and reads memory outside the intended array boundary. The result is undefined behavior in a kernel context.
Root Cause
The root cause is missing input validation in at91_gpio_probe(). The function does not check the return value of the OF alias lookup. Kernel developers relied on BUG() as a runtime guard, but this macro is not a substitute for explicit bounds validation. The fix adds explicit checks that verify the alias index is present and within range before it is used to index gpio_chips.
Attack Vector
Exploitation requires local access with low privileges on a Linux system running an affected kernel on AT91 hardware. An attacker who can influence device tree parsing or trigger driver probe operations with a malformed device tree may induce the out-of-bounds access. No user interaction is required. Successful triggering can leak kernel memory contents or destabilize the pinctrl subsystem, causing denial of service.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream commit references for the technical fix details.
Detection Methods for CVE-2025-38286
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing at91_gpio_probe or pinctrl-at91 in dmesg output.
- Kernel Address Sanitizer (KASAN) reports flagging out-of-bounds reads in the gpio_chips array on AT91 systems.
- Driver initialization failures for the pinctrl-at91 module during boot on affected embedded platforms.
Detection Strategies
- Inventory Linux hosts running AT91-based hardware and correlate kernel versions against the patched stable branches listed in the kernel git commit references.
- Enable KASAN in test builds to surface any out-of-bounds access patterns during driver initialization.
- Monitor Debian package inventories for linux-image versions predating the fixes referenced in the Debian LTS Announcement.
Monitoring Recommendations
- Aggregate kernel logs from embedded and IoT fleets to a centralized store and alert on pinctrl or gpio subsystem faults.
- Track kernel version compliance across Linux endpoints and flag hosts running unpatched stable branches.
- Review device tree changes and firmware updates on AT91 platforms, since malformed device tree entries are the primary trigger surface.
How to Mitigate CVE-2025-38286
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the vendor advisories and rebuild affected kernel images.
- Update Debian 11 systems using the fixed packages from the Debian LTS Announcement.
- Restrict local shell access on affected embedded systems to trusted administrators only.
- Audit device tree source files and blob overlays for correctness on AT91-based hardware.
Patch Information
The fix is available across multiple Linux stable branches. Relevant commits include eb435bc4c74acbb286cec773deac13d117d3ef39, 264a5cf0c422e65c94447a1ebebfac7c92690670, 288c39286f759314ee8fb3a80a858179b4f306da, 2ecafe59668d2506a68459a9d169ebe41a147a41, 762ef7d1e6eefad9896560bfcb9bcf7f1b6df9c1, db5665cbfd766db7d8cd0e5fd6e3c0b412916774, e02e12d6a7ab76c83849a4122785650dc7edef65, and f1c1fdc41fbf7e308ced9c86f3f66345a3f6f478. See the Kernel Git Commit Update for the patch content.
Workarounds
- Disable the pinctrl-at91 driver on systems that do not require AT91 GPIO functionality by removing CONFIG_PINCTRL_AT91 from the kernel configuration and rebuilding.
- Restrict device tree modification privileges to prevent malformed alias entries from being loaded during boot.
- Limit physical and administrative access to embedded systems running unpatched kernels until updates can be deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
