CVE-2025-40296

Vulnerability

Overview

The vulnerability is a double-free bug in the Linux kernel's int3472 platform driver (drivers/platform/x86/intel/int3472/). When regulator_unregister() is called, it already frees the associated GPIO device. However, the driver also attempts to free the same GPIO device again, leading to a double-free condition. This issue manifests on ThinkPad X9 (Lunar Lake) systems and can be triggered during driver unregistration or probe deferral.

Exploitation

Conditions

The double free occurs when the driver defers its probe, causing the reference count of the pinctrl_intel_platform module to unexpectedly drop to zero. The same behavior can be reproduced by directly unloading the module. Exploitation requires local access to the system, as the attacker must be able to trigger driver unload or probe deferral. No special privileges are needed beyond the ability to interact with kernel modules.

Impact

When the double free occurs, it corrupts kernel memory, leading to random failures in other drivers that attempt to allocate interrupts. Notably, the Intel THC (Touch Host Controller) driver is affected, resulting in system instability, crashes, or denial of service. The vulnerability does not directly allow privilege escalation but can disrupt system operation.

Mitigation

The fix is included in Linux kernel stable commit [1], which removes the redundant release of the GPIO device during regulator unregistration. Users should apply the kernel patch or update to a version containing this commit to prevent the double free.