CVE-2025-40296 (GCVE-0-2025-40296)

Vulnerability from cvelistv5 – Published: 2025-12-08 00:46 – Updated: 2025-12-08 00:46
VLAI?
Title
platform/x86: int3472: Fix double free of GPIO device during unregister
Summary
In the Linux kernel, the following vulnerability has been resolved: platform/x86: int3472: Fix double free of GPIO device during unregister regulator_unregister() already frees the associated GPIO device. On ThinkPad X9 (Lunar Lake), this causes a double free issue that leads to random failures when other drivers (typically Intel THC) attempt to allocate interrupts. The root cause is that the reference count of the pinctrl_intel_platform module unexpectedly drops to zero when this driver defers its probe. This behavior can also be reproduced by unloading the module directly. Fix the issue by removing the redundant release of the GPIO device during regulator unregistration.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1e5d088a52c207bcef6a43a6f6ffe162c514ed64 , < b8113bb56c45bd17bac5144b55591f9cdbd6aabe (git)
Affected: 1e5d088a52c207bcef6a43a6f6ffe162c514ed64 , < f0f7a3f542c1698edb69075f25a3f846207facba (git)
Create a notification for this product.
    Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/intel/int3472/clk_and_regulator.c",
            "include/linux/platform_data/x86/int3472.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b8113bb56c45bd17bac5144b55591f9cdbd6aabe",
              "status": "affected",
              "version": "1e5d088a52c207bcef6a43a6f6ffe162c514ed64",
              "versionType": "git"
            },
            {
              "lessThan": "f0f7a3f542c1698edb69075f25a3f846207facba",
              "status": "affected",
              "version": "1e5d088a52c207bcef6a43a6f6ffe162c514ed64",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/intel/int3472/clk_and_regulator.c",
            "include/linux/platform_data/x86/int3472.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: int3472: Fix double free of GPIO device during unregister\n\nregulator_unregister() already frees the associated GPIO device. On\nThinkPad X9 (Lunar Lake), this causes a double free issue that leads to\nrandom failures when other drivers (typically Intel THC) attempt to\nallocate interrupts. The root cause is that the reference count of the\npinctrl_intel_platform module unexpectedly drops to zero when this\ndriver defers its probe.\n\nThis behavior can also be reproduced by unloading the module directly.\n\nFix the issue by removing the redundant release of the GPIO device\nduring regulator unregistration."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-08T00:46:20.017Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b8113bb56c45bd17bac5144b55591f9cdbd6aabe"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0f7a3f542c1698edb69075f25a3f846207facba"
        }
      ],
      "title": "platform/x86: int3472: Fix double free of GPIO device during unregister",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40296",
    "datePublished": "2025-12-08T00:46:20.017Z",
    "dateReserved": "2025-04-16T07:20:57.185Z",
    "dateUpdated": "2025-12-08T00:46:20.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40296\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-08T01:16:01.690\",\"lastModified\":\"2025-12-08T18:26:49.133\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nplatform/x86: int3472: Fix double free of GPIO device during unregister\\n\\nregulator_unregister() already frees the associated GPIO device. On\\nThinkPad X9 (Lunar Lake), this causes a double free issue that leads to\\nrandom failures when other drivers (typically Intel THC) attempt to\\nallocate interrupts. The root cause is that the reference count of the\\npinctrl_intel_platform module unexpectedly drops to zero when this\\ndriver defers its probe.\\n\\nThis behavior can also be reproduced by unloading the module directly.\\n\\nFix the issue by removing the redundant release of the GPIO device\\nduring regulator unregistration.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b8113bb56c45bd17bac5144b55591f9cdbd6aabe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0f7a3f542c1698edb69075f25a3f846207facba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.