CVE-2025-22095

What it actually does

Failure to reset regulator count to zero after regulator_bulk_get() error allows regulator_bulk_free() to dereference invalid pointers during subsequent PCIe link failure, resulting in kernel panic.

Why it matters to the business

Unexpected kernel panics on systems using affected Broadcom STB PCIe controllers under error conditions, leading to system instability and potential service disruption on Red Hat real-time kernels.

How an attack unfolds

An attacker triggers error conditions in the brcmstb PCIe driver by causing regulator_bulk_get() to fail with no regulators created, then forces a PCIe link-up failure so that regulator_bulk_free() executes and panics the kernel.

How to fix it

Update all affected kernel-rt packages on Red Hat Enterprise Linux 9.2 EUS (nfv and realtime) to version 0:5.14.0-284.95.1.rt14.380.el9_2 or later.

How to confirm the fix worked

Confirm running kernel version matches or exceeds the listed fixed release; inject regulator and link errors in a test environment to verify absence of panic.

Typical attack path

1. Cause regulator_bulk_get() to return an error with zero regulators allocated
2. Trigger PCIe link-up failure in brcmstb driver
3. Invoke regulator_bulk_free() on uninitialized state
4. Trigger kernel panic via invalid memory access

How to detect it

Review kernel logs and crash dumps for panic traces containing regulator_bulk_free, brcmstb, or regulator_bulk_get error paths; correlate with PCIe initialization failures.

• regulator_bulk_free
• regulator_bulk_get
• brcmstb

What your security team should do

• Apply the listed kernel-rt package updates to all affected systems
• Monitor kernel logs for brcmstb and regulator_bulk_free related panics
• Prioritize patching on real-time and NFV workloads due to stability impact