CVE-2025-23137: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel has been identified and assigned CVE-2025-23137. The issue involves a missing NULL pointer check in the amd_pstate_update function within the cpufreq/amd-pstate component. The vulnerability was disclosed on April 16, 2025 (NVD).

The vulnerability stems from a failure to verify if the 'policy' pointer is NULL before dereferencing it in the amd_pstate_update function. According to Red Hat's assessment, this vulnerability has been assigned a CVSS v3.1 base score of 5.5, with attack vector being Local (Red Hat).

The vulnerability could potentially lead to a system crash or denial of service condition when the NULL pointer is dereferenced. The impact is limited to systems using AMD's P-state driver for CPU frequency scaling (Red Hat).

The vulnerability requires local access to the system to be exploited. The attack complexity is considered low, requiring low privileges and no user interaction (Red Hat).

The vulnerability has been fixed in various Linux distributions. Debian has marked it as fixed in bullseye (5.10.234-1) and bookworm (6.1.133-1) releases, while it remains vulnerable in trixie and sid versions. Red Hat Enterprise Linux 9 has deferred the fix for both kernel and kernel-rt packages (Debian, Red Hat).