Executive brief
A vulnerability in the Linux kernel's i.MX System Controller Key driver could lead to memory corruption when the driver is unloaded. This component is typically used in embedded systems to handle power or function keys. An exploit could cause a system crash or unpredictable behavior, potentially impacting the reliability of industrial or automotive devices using this hardware.
Technical details
A vulnerability in 'drivers/input/keyboard/imx_sc_key.c' exists because the 'imx_sc_key_probe' function incorrectly passes the address of a pointer (&priv) instead of the pointer itself (priv) to 'devm_add_action_or_reset'. Since '&priv' refers to a location on the kernel stack that becomes invalid after the probe function returns, the subsequent execution of 'imx_sc_key_action' during driver detachment or unload results in memory corruption. This is a local vulnerability requiring the ability to trigger driver unloading or a failed probe. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel 768062fd1284 to fixed versions (including 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.11.11, 6.12.2)
Timeline
- 2025-11-01: other: Patch authored
- 2025-12-04: disclosed: CVE published
- 2025-12-07: patched: Patch committed to stable trees
References
- https://git.kernel.org/stable/c/3e96803b169dc948847f0fc2bae729a80914eb7b
- https://git.kernel.org/stable/c/4ce5218b101205b3425099fe3df88a61b58f9cc2
- https://git.kernel.org/stable/c/56881294915a6e866d31a46f9bcb5e19167cfbaa
- https://git.kernel.org/stable/c/6524a15d33951b18ac408ebbcb9c16e14e21c336
- https://git.kernel.org/stable/c/a155292c3ce722036014da5477ee0e4c87b5e6b3
- https://git.kernel.org/stable/c/ca9a08de9b294422376f47ade323d69590dbc6f2
- https://git.kernel.org/stable/c/d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4