CVE-2025-38631

What it actually does

Enabling runtime PM for clock suppliers in a power domain without an explicit resume allows the power domain to be cut off after clk_register(), leading to a synchronous external abort when clk_mux_get_parent attempts to access BLK_CTL registers during of_clk_add_hw_provider.

Why it matters to the business

Kernel crashes during device probing or boot on affected systems can cause unplanned downtime and require manual intervention to restore service; the issue affects Linux kernel-based deployments including certain container images.

How an attack unfolds

An attacker with the ability to trigger deferred_probe_work_func on an imx95 platform (for example via crafted device tree or module load) can induce the crash path, though the flaw is a stability bug rather than a code-execution vector and no named threat actors have been observed exploiting it.

How to fix it

Update to Linux kernel commit c1dead8bb303f86905ea6a09e5acda931165453b or later; for Chainguard images upgrade the listed openjdk-21-openj9 packages to version 0.53.0-r0 or newer; replace pm_runtime_enable/pm_runtime_disable pairs with devm_pm_runtime_enable and remove manual disable calls in cleanup paths.

How to confirm the fix worked

Confirm the presence of devm_pm_runtime_enable in imx95_bc_probe and absence of the original pm_runtime_disable in the error path; boot an imx95 system and verify that deferred_probe_work_func no longer triggers the synchronous abort.

Typical attack path

1. Trigger platform device probe for imx95-blk-ctl
2. Call pm_runtime_enable without a preceding resume
3. clk_register completes and power domain is cut off
4. of_clk_add_hw_provider invokes clk_core_reparent_orphans_nolock
5. clk_mux_get_parent dereferences hardware registers that are now inaccessible
6. Synchronous external abort terminates the workqueue

How to detect it

Search kernel logs for the exact call trace containing clk_mux_get_parent, clk_core_reparent_orphans_nolock, and imx95_bc_probe; correlate with workqueue events_unbound and deferred_probe_work_func entries around the time of the abort.

What your security team should do

• Prioritize kernel updates on all imx95-based systems within normal maintenance windows
• Scan Chainguard container images for the affected openjdk-21-openj9 packages and rebuild with 0.53.0-r0
• Monitor boot logs for 'synchronous external abort' and 'clk_mux_get_parent' entries
• Test runtime PM changes in staging environments before production rollout