CVE-2025-68222

What it actually does

Uninitialized fields in s32_pinctrl_desc allocated via devm_kmalloc cause num_custom_params and related members to hold garbage values, leading to invalid allocations and parse failures inside pinconf_generic_parse_dt_config during device tree configuration.

Why it matters to the business

Systems using affected Chainguard GitLab images or upstream Linux kernels on NXP S32G hardware may experience intermittent driver probe failures for peripherals such as I2C, resulting in unreliable hardware initialization and potential service degradation until patched.

How an attack unfolds

An attacker with the ability to influence device tree nodes or trigger pinctrl binding during boot or driver load can cause the kernel to dereference uninitialized data, producing allocation warnings and downstream parse errors that disrupt dependent drivers; no named threat actors are associated.

How to fix it

Update affected Chainguard packages to the versions fixed in 17.8.2-r0 and rebuild or redeploy containers; for the Linux kernel apply commit 3b90bd8aaeb21b513ecc4ed03299e80ece44a333 or later stable releases that replace devm_kmalloc with devm_kzalloc in s32_pinctrl_probe.

How to confirm the fix worked

Confirm the presence of devm_kzalloc in the s32_pinctrl_probe function and verify that s32_pinctrl_desc initialization now zeros all fields; retest device probing for i2c and pinctrl nodes to ensure absence of the previously observed allocation warnings and parse errors.

Typical attack path

1. Trigger platform device probing for pinctrl or dependent drivers such as i2c-imx
2. Reach s32_dt_node_to_map which calls pinconf_generic_parse_dt_config with uninitialized num_custom_params
3. Induce large or invalid kmalloc attempts leading to page allocator warnings
4. Observe parse failures that prevent proper pin configuration and device registration

How to detect it

Search kernel logs for the strings __alloc_pages_noprof warnings originating from pinconf_generic_parse_dt_config, s32_dt_node_to_map, or messages containing could not parse node property together with s32g-siul2-pinctrl.

• WARNING: CPU:.*__alloc_pages_noprof.*pinconf_generic_parse_dt_config
• s32g-siul2-pinctrl.*could not parse node property
• pca953x.*failed writing register
• devm_kmalloc.*s32_pinctrl_desc

What your security team should do

• Apply the listed fixed package versions or kernel commit immediately on all affected Chainguard GitLab deployments and NXP S32G systems
• Monitor kernel logs for pinctrl and pinconf allocation warnings during boot and driver initialization
• Prioritize kernel updates on production hardware before enabling additional peripheral drivers