CVE-2025-68354

Vulnerability

Overview

The Linux kernel's regulator subsystem maintains a regulator_supply_alias_list to map supply aliases. The functions regulator_supply_alias(), regulator_register_supply_alias(), and regulator_unregister_supply_alias() accessed this list without any locking. This lack of synchronization allows concurrent registration, unregistration, and lookups to race [1].

Exploitation and

Attack Surface

Exploitation requires the ability to trigger concurrent operations on the alias list from multiple threads or processes. An attacker with sufficient privileges to register or unregister regulator supply aliases (e.g., via module loading or device tree overlays) could orchestrate a race condition. No authentication beyond standard kernel access is needed, but the attacker must be able to execute code in a context where regulator operations are performed [2].

Impact

A race can lead to a use-after-free if an alias entry is removed while another thread reads it, potentially allowing memory corruption and arbitrary code execution. Alternatively, the race can create duplicate alias entries, causing inconsistent supply mappings that misconfigure power management hardware, leading to system instability or denial of service [3].

Mitigation

The fix protects all traversals, insertions, and deletions on regulator_supply_alias_list with the existing regulator_list_mutex. This patch has been applied to the stable kernel tree and is part of the Linux kernel vulnerability disclosure process. Affected users should update to a kernel version containing commit a9864d42ebcd or backport the fix [1][3].