CVE-2025-38446

What it actually does

Out-of-bounds read in __clk_register when accessing parent_names array using hardcoded size instead of ARRAY_SIZE() for num_parents==4, triggered during clk_hw_register_mux on i.MX95 hardware during deferred probe.

Why it matters to the business

Kernel panic or memory corruption on affected NXP i.MX95-based systems during boot or device initialization, leading to denial of service; low exploitation likelihood but requires prompt patching on Debian Linux 13/14 and upstream kernels to avoid operational disruption.

How an attack unfolds

An attacker with local access or the ability to trigger deferred_probe_work_func on vulnerable i.MX95 hardware causes __clk_register to read past the parent_names array bounds, resulting in KASAN-detected global-out-of-bounds; no public exploits or threat actors observed.

How to fix it

Update to fixed kernel versions: Debian 13 to 6.12.41-1, Debian 14 to 6.16.3-1, or mainline commit c476d627584b7589a134a8b48dd5c6639e4401c5; rebuild and reboot systems using the clk-imx driver.

How to confirm the fix worked

Verify kernel version after upgrade; confirm absence of KASAN reports in dmesg during imx95_bc_probe; test clock registration on i.MX95 hardware.

Typical attack path

1. Gain local code execution or trigger hardware probe on NXP i.MX95 system
2. Force clk registration path via events_unbound workqueue
3. Invoke __clk_hw_register_mux with num_parents=4 using hardcoded parent_names index
4. Trigger out-of-bounds read in __clk_register leading to crash or potential corruption

How to detect it

Search kernel logs for KASAN reports mentioning __clk_register and imx95_bc_probe; inspect dmesg for global-out-of-bounds during deferred_probe_work_func on NXP i.MX95 boards.

• KASAN: global-out-of-bounds in __clk_register
• imx95_bc_probe
• Read of size 8 at addr ffff800086988e78
• Workqueue: events_unbound deferred_probe_work_func

What your security team should do

• Prioritize patching Debian and upstream Linux systems within standard maintenance windows given low EPSS and no KEV status
• Monitor for kernel oops or KASAN reports involving __clk_register on i.MX95 platforms
• Apply fixed versions immediately on production hardware using the affected clock driver