CVE-2025-38027

What it actually does

Use-after-free due to passing a stack-allocated of_regulator_match array to of_regulator_match(); on probe failure devm_of_regulator_put_matches() later calls of_node_put() on the now-invalid stack pointer.

Why it matters to the business

Kernel instability or crashes on systems using the max20086 regulator driver, especially during hardware initialization failures; high downstream prevalence in Linux distributions increases patch urgency despite low exploitation likelihood.

How an attack unfolds

An attacker with local access or the ability to trigger regulator probe failures (e.g., via hardware manipulation or faulty device trees) can induce the use-after-free condition, resulting in a kernel oops and potential denial of service; listed threat actors have targeted similar Linux kernel UAF primitives for privilege escalation but no public exploitation of this specific issue is known.

How to fix it

Update the Linux kernel to commit 6ba30f7aa2c550b2ac04f16b81a19a8c045b8660 or later; for Mageia 5 packages upgrade keepassx to 0.4.4-1.mga5 or newer equivalent kernel packages containing the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 6ba30f7aa2c550b2ac04f16b81a19a8c045b8660; attempt to load the max20086 driver with a failing DEVICE_ID read and verify absence of kobject_put stack traces in dmesg.

Typical attack path

1. Trigger max20086 device probe failure (e.g., read of DEVICE_ID register returns error)
2. of_regulator_match() is invoked with stack-allocated matches array
3. devm_of_regulator_put_matches() stores the stack pointer inside a devres-allocated structure
4. Probe failure causes the devres release function to execute after the original stack frame has exited
5. of_node_put() is called on the dangling stack pointer, triggering kobject warnings and stack trace

How to detect it

Review dmesg and kernel logs for strings indicating max20086 probe failure followed by kobject_put warnings on uninitialized objects; correlate with device tree entries referencing max20086 regulators; examine crash dumps for stack traces involving devm_of_regulator_put_matches.

• max20086.*Failed to read DEVICE_ID reg
• kobject:.*is not initialized, yet
• kobject_put() is being called

What your security team should do

• Prioritize kernel updates on all systems exposing the max20086 regulator driver
• Monitor EPSS trend and threat actor activity around similar Linux kernel UAF issues
• Test probe-failure paths in lab environments before deploying to production
• Apply updates within normal patch windows given low EPSS and absence from KEV