CVE-2025-38446: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38446 Overview

CVE-2025-38446 is an out-of-bounds read vulnerability in the Linux kernel's i.MX clock (clk) driver. The flaw resides in the dispmix_csr_clk_dev_data structure handling within the display mix subsystem for NXP i.MX95 hardware. When num_parents equals 4, the __clk_register() function reads beyond the bounds of the parent_names member because the code uses a hardcoded value instead of ARRAY_SIZE(). Kernel Address Sanitizer (KASAN) confirms the out-of-bounds read during device probe via imx95_bc_probe(). The issue affects Linux kernel 6.16 release candidates (rc1 through rc5) and is classified under [CWE-125].

Critical Impact
A local, low-privileged user can trigger an out-of-bounds read in kernel memory, potentially exposing sensitive kernel data or causing a denial of service on affected NXP i.MX95 platforms.

Affected Products

Linux kernel 6.16-rc1
Linux kernel 6.16-rc2 through 6.16-rc5
NXP i.MX95 platforms using the imx95_bc_probe display mix clock driver

Discovery Timeline

2025-07-25 - CVE-2025-38446 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38446

Vulnerability Analysis

The vulnerability exists in the dispmix_csr_clk_dev_data initialization path within the Linux kernel's i.MX clock driver. During the clock registration flow, __clk_register() iterates over the parent_names array using a num_parents value that can exceed the actual array size. When num_parents is 4, the loop reads past the end of the statically declared parent_names member.

KASAN detected the issue during boot on the NXP i.MX95 19x19 board. The failure occurred in the deferred_probe_work_func workqueue while executing __clk_hw_register_mux() from imx95_bc_probe(). The out-of-bounds read is 8 bytes wide and originates from a global memory region.

The kernel patches replace the hardcoded index with ARRAY_SIZE(), ensuring the loop honors the true size of the parent_names array. See the upstream commits a956daad67ce, aacc875a448d, and fcee75daecc5 for the fix.

Root Cause

The root cause is a mismatch between the declared size of the parent_names array in dispmix_csr_clk_dev_data and the hardcoded parent count used at registration time. Using a literal value instead of ARRAY_SIZE() broke the invariant that iteration bounds must reflect the actual buffer length.

Attack Vector

Exploitation requires local access with low privileges on a system running an affected kernel on NXP i.MX95 hardware. Triggering the vulnerable code path relies on the display mix clock probe sequence. The primary consequences are kernel information disclosure through leaked adjacent global data and availability impact through KASAN-induced panics or driver failure.

// Reference KASAN report from the upstream commit message
BUG: KASAN: global-out-of-bounds in __clk_register+0x1844/0x20d8
Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59
Call trace:
  __asan_report_load8_noabort
  __clk_register
  clk_hw_register
  __clk_hw_register_mux
  imx95_bc_probe

Detection Methods for CVE-2025-38446

Indicators of Compromise

KASAN reports referencing global-out-of-bounds in __clk_register in kernel logs
Kernel oops or backtrace referencing imx95_bc_probe and __clk_hw_register_mux
Failed or repeated deferred probe events for the i.MX95 display mix clock controller

Detection Strategies

Inventory Linux hosts and embedded devices running kernel 6.16-rc1 through 6.16-rc5, focusing on NXP i.MX95 hardware
Enable KASAN on test and development kernels to surface out-of-bounds accesses during boot and driver probe
Correlate dmesg output with driver probe telemetry to flag anomalous clock registration failures

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized logging pipeline and alert on KASAN or BUG lines
Monitor deferred probe retries and device initialization failures on i.MX95 fleets
Track kernel versions across embedded and IoT assets to detect installation of unpatched 6.16 release candidates

How to Mitigate CVE-2025-38446

Immediate Actions Required

Upgrade to a Linux kernel build that includes the upstream fix commits a956daad67ce, aacc875a448d, or fcee75daecc5
Avoid deploying Linux 6.16 release candidates on production NXP i.MX95 hardware until the fix is integrated
Restrict local access on affected embedded systems to trusted administrators

Patch Information

The fix replaces the hardcoded parent count with ARRAY_SIZE(parent_names) in dispmix_csr_clk_dev_data handling. Apply one of the upstream stable commits: a956daad67ce, aacc875a448d, or fcee75daecc5. Rebuild and redeploy the kernel image on affected i.MX95 boards.

Workarounds

Downgrade to a stable Linux kernel release that predates the vulnerable 6.16-rc series on affected boards
Disable the i.MX95 display mix clock controller in device tree configurations if the subsystem is not required
Limit shell and workload access on i.MX95 devices to reduce local attack surface

bash

# Verify running kernel version on affected i.MX95 hosts
uname -r

# Inspect kernel ring buffer for KASAN reports tied to this CVE
dmesg | grep -E 'KASAN|__clk_register|imx95_bc_probe'