[SRU][J][PATCH 0/1] CVE-2025-38259

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-38259

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: wcd9335: Fix missing free of regulator supplies

Driver gets and enables all regulator supplies in probe path
(wcd9335_parse_dt() and wcd9335_power_on_reset()), but does not cleanup in
final error paths and in unbind (missing remove() callback). This leads to
leaked memory and unbalanced regulator enable count during probe errors or
unbind.

Fix this by converting entire code into devm_regulator_bulk_get_enable() which
also greatly simplifies the code.

[ Fix ]

jammy/linux: backported from 9079db287fc3

Note that devm_regulator_bulk_get_enable() does not exist in the 5.15
kernel, so its semantics were reimplemented for jammy: the supplies[]
struct field and names are kept, devm_regulator_bulk_get() is used to fix
the memory leak, and regulator_bulk_enable() in parse_dt is paired with
devm_add_action_or_reset() to disable the supplies on unbind or error,
fixing the enable-count imbalance.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A bad fix would affect systems that use the Qualcomm WCD9335 audio codec,
found on certain Qualcomm SoC based boards, where a regression could show
up as failed audio codec probe or power sequencing issues during driver
bind and unbind. Systems without this codec do not load the driver and are
not affected.

[ Other Info ]

Kybele flow-v11-25-ga27c0fa6. Reference: c737c315/v1