Memory Leak and Regulator Management Issue in Linux Kernel - CVE-2025-38259
Summary
CVE-2025-38259: In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd9335: Fix missing free of regulator supplies Driver gets and enables all regulator supplies in probe path (wcd9335_parse_dt() and wcd93... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It supports a wide range of functionalities, including process management, memory management, device drivers, and system calls. The vulnerability identified as CVE-2025-38259 affects the ASoC (ALSA System on Chip) subsystem, specifically the wcd9335 codec driver, which is responsible for audio processing in certain hardware configurations. This vulnerability can lead to memory leaks and unbalanced regulator enable counts, potentially affecting system stability and performance.
Vulnerability Detail
In the Linux kernel, specifically within the ASoC subsystem for the wcd9335 codec driver, a vulnerability exists due to improper management of regulator supplies. The driver acquires and enables all regulator supplies during the probe process but fails to release them in error scenarios or during unbinding, leading to memory leaks and unbalanced regulator enable counts. This can result in increased memory usage and potential system instability, especially during probe errors or when the driver is unbound.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually monitor and manage the regulator supplies in their applications to prevent memory leaks. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
CVE-2025-38259 is a critical vulnerability in the Linux kernel affecting the wcd9335 codec driver, leading to memory leaks and unbalanced regulator management. It is essential for users to update their systems to the latest patched version to mitigate potential risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38259 is a vulnerability in the Linux kernel related to improper management of regulator supplies in the wcd9335 codec driver, leading to memory leaks.
This vulnerability can lead to increased memory usage and potential system instability, especially during probe errors or when the driver is unbound.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any installation.
Yes, a patch is available. Users should update their Linux package to the latest version to ensure the vulnerability is fixed.
If immediate updates are not possible, consider implementing temporary workarounds to manage regulator supplies manually, but prioritize updating as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
