CVE-2025-38286

What it actually does

Unvalidated OF alias index passed to gpio_chips array access in at91_gpio_probe allows out-of-bounds read/write when alias lookup fails or returns an unexpected value; BUG() may be compiled out and provides no protection.

Why it matters to the business

Kernel memory corruption or crash on systems using the at91 pinctrl driver can cause denial of service or enable local privilege escalation; widespread Linux LTS deployments increase operational risk and patch urgency.

How an attack unfolds

An attacker with local access or the ability to influence device-tree aliases supplies an invalid or missing OF alias; at91_gpio_probe dereferences the unchecked value as an array index into gpio_chips, resulting in out-of-bounds memory access that can be leveraged for privilege escalation similar to other recent Linux kernel exploits.

How to fix it

Upgrade linux-lts (Alpaquita:23) to 6.1.56-r0 or later, linux-lts (Alpaquita:stream) to 6.6.58-r0 or later, and stable/linux.git to commit 264a5cf0c422e65c94447a1ebebfac7c92690670; rebuild and reboot all affected kernels.

How to confirm the fix worked

Confirm presence of the fix commit in the running kernel source or binary; verify that at91_gpio_probe now validates the OF alias result before indexing gpio_chips; re-test probe paths with deliberately invalid aliases.

Typical attack path

1. Obtain local execution or control over device-tree loading on an at91-based system
2. Trigger gpio driver probe with a missing or out-of-range OF alias
3. Unvalidated alias value used as index into gpio_chips array
4. Out-of-bounds memory access occurs, enabling corruption or information leak
5. Chain with other kernel primitives for privilege escalation or denial of service

How to detect it

Review kernel logs for at91_gpio_probe failures or unexpected alias values; inspect device-tree blobs and boot logs for OF alias anomalies; correlate with privilege-escalation indicators from related Linux kernel CVEs.

What your security team should do

• Apply the listed fixed versions immediately on all at91 pinctrl systems
• Prioritize patching in environments with local untrusted users or dynamic device-tree loading
• Monitor EPSS trend and similar privilege-escalation campaigns for acceleration in exploitation
• Remove or restrict unnecessary at91 GPIO devices from device trees where feasible