linux-cve-announce - CVE-2025-40296: platform/x86: int3472: Fix double free of GPIO device during unregister

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025120818-CVE-2025-40296-0769@gregkh>
Date: Mon,  8 Dec 2025 09:47:21 +0900
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-40296: platform/x86: int3472: Fix double free of GPIO device during unregister

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: int3472: Fix double free of GPIO device during unregister

regulator_unregister() already frees the associated GPIO device. On
ThinkPad X9 (Lunar Lake), this causes a double free issue that leads to
random failures when other drivers (typically Intel THC) attempt to
allocate interrupts. The root cause is that the reference count of the
pinctrl_intel_platform module unexpectedly drops to zero when this
driver defers its probe.

This behavior can also be reproduced by unloading the module directly.

Fix the issue by removing the redundant release of the GPIO device
during regulator unregistration.

The Linux kernel CVE team has assigned CVE-2025-40296 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.16 with commit 1e5d088a52c207bcef6a43a6f6ffe162c514ed64 and fixed in 6.17.8 with commit b8113bb56c45bd17bac5144b55591f9cdbd6aabe
	Issue introduced in 6.16 with commit 1e5d088a52c207bcef6a43a6f6ffe162c514ed64 and fixed in 6.18 with commit f0f7a3f542c1698edb69075f25a3f846207facba

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-40296
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/platform/x86/intel/int3472/clk_and_regulator.c
	include/linux/platform_data/x86/int3472.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b8113bb56c45bd17bac5144b55591f9cdbd6aabe
	https://git.kernel.org/stable/c/f0f7a3f542c1698edb69075f25a3f846207facba