CVE-2025-38668

In the Linux kernel, the following vulnerability has been resolved:

regulator: core: fix NULL dereference on unbind due to stale coupling data

Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can lead to NULL pointer dereference when regulators are accessed post-unbind.

This can happen during runtime PM or other regulator operations that rely on coupling metadata.

For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers a panic in regulator_lock_recursive() due to stale coupling state.

Ensure n_coupled is set to 0 to prevent access to invalid pointers.

This vulnerability in the regulator core occurs because stale coupling metadata is left behind after unbinding, which can cause a NULL pointer dereference when regulators are later accessed. The CVSS assessment requires PR:H because only a privileged local user (e.g., root or a kernel module with equivalent rights) can unbind regulators or manipulate runtime-PM states that trigger this bug. Such operations are not available to unprivileged users, which significantly limits the attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.