APPLIED: [SRU][J][PATCH 0/1] CVE-2025-38259

[Stefan Bader]

On 11/09/2026 00:04, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-38259
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> ASoC: codecs: wcd9335: Fix missing free of regulator supplies
> 
> Driver gets and enables all regulator supplies in probe path
> (wcd9335_parse_dt() and wcd9335_power_on_reset()), but does not cleanup in
> final error paths and in unbind (missing remove() callback). This leads to
> leaked memory and unbalanced regulator enable count during probe errors or
> unbind.
> 
> Fix this by converting entire code into devm_regulator_bulk_get_enable() which
> also greatly simplifies the code.
> 
> [ Fix ]
> 
> jammy/linux: backported from 9079db287fc3
> 
> Note that devm_regulator_bulk_get_enable() does not exist in the 5.15
> kernel, so its semantics were reimplemented for jammy: the supplies[]
> struct field and names are kept, devm_regulator_bulk_get() is used to fix
> the memory leak, and regulator_bulk_enable() in parse_dt is paired with
> devm_add_action_or_reset() to disable the supplies on unbind or error,
> fixing the enable-count imbalance.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A bad fix would affect systems that use the Qualcomm WCD9335 audio codec,
> found on certain Qualcomm SoC based boards, where a regression could show
> up as failed audio codec probe or power sequencing issues during driver
> bind and unbind. Systems without this codec do not load the driver and are
> not affected.
> 
> [ Other Info ]
> 
> Kybele flow-v11-25-ga27c0fa6. Reference: c737c315/v1
> 

Applied to jammy:linux/master-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260916/9789f7e5/attachment.sig>