In the Linux kernel, the following vulnerability has been resolved:
regulator: core: fix NULL dereference on unbind due to stale coupling data
Failing to reset couplingdesc.ncoupled after freeing coupled_rdevs can lead to NULL pointer dereference when regulators are accessed post-unbind.
This can happen during runtime PM or other regulator operations that rely on coupling metadata.
For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers a panic in regulatorlockrecursive() due to stale coupling state.
Ensure n_coupled is set to 0 to prevent access to invalid pointers.
[
{
"deprecated": false,
"id": "CVE-2025-38668-04b257f6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca9bef9ba1a6be640c87bf802d2e9e696021576a",
"digest": {
"line_hashes": [
"31155393458918474692414483796049467115",
"204462867749586892274229186749122802587",
"135274942774477081838872292373628120658"
],
"threshold": 0.9
},
"target": {
"file": "drivers/regulator/core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38668-1af10b15",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7574892e259bbb16262ebfb4b65a2054a5e03a49",
"digest": {
"function_hash": "176076357460144966431105557976972061122",
"length": 927.0
},
"target": {
"function": "regulator_remove_coupling",
"file": "drivers/regulator/core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38668-2c617a9e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c49eac796681e250e34156bafb643930310bd4a",
"digest": {
"line_hashes": [
"31155393458918474692414483796049467115",
"204462867749586892274229186749122802587",
"135274942774477081838872292373628120658"
],
"threshold": 0.9
},
"target": {
"file": "drivers/regulator/core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38668-71531335",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7574892e259bbb16262ebfb4b65a2054a5e03a49",
"digest": {
"line_hashes": [
"32288432546446399061007815189048981851",
"321785961285733098544509781824606041674",
"135274942774477081838872292373628120658"
],
"threshold": 0.9
},
"target": {
"file": "drivers/regulator/core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38668-837262b4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7e59c5fd7a0f5e16e75a30a89ea2c4ab88612b8",
"digest": {
"line_hashes": [
"31155393458918474692414483796049467115",
"204462867749586892274229186749122802587",
"135274942774477081838872292373628120658"
],
"threshold": 0.9
},
"target": {
"file": "drivers/regulator/core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38668-afbad8da",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7e59c5fd7a0f5e16e75a30a89ea2c4ab88612b8",
"digest": {
"function_hash": "294505832959268315033934477709041289169",
"length": 941.0
},
"target": {
"function": "regulator_remove_coupling",
"file": "drivers/regulator/core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38668-d5a26b84",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c49eac796681e250e34156bafb643930310bd4a",
"digest": {
"function_hash": "294505832959268315033934477709041289169",
"length": 941.0
},
"target": {
"function": "regulator_remove_coupling",
"file": "drivers/regulator/core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38668-e3ac48dc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca9bef9ba1a6be640c87bf802d2e9e696021576a",
"digest": {
"function_hash": "294505832959268315033934477709041289169",
"length": 941.0
},
"target": {
"function": "regulator_remove_coupling",
"file": "drivers/regulator/core.c"
},
"signature_type": "Function",
"signature_version": "v1"
}
]