CVE-2025-37830: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-37830) was identified in the Linux kernel, specifically affecting the CPU frequency scaling (cpufreq) subsystem. The vulnerability was disclosed on May 8, 2025, and involves a NULL pointer dereference issue in the SCMI (System Control and Management Interface) driver (NVD, Wiz).

The vulnerability occurs when the scmi_cpufreq_get_rate() function fails to validate the return value from cpufreq_cpu_get_raw(). Specifically, cpufreq_cpu_get_raw() can return NULL when the target CPU is not present in the policy->cpus mask, but scmi_cpufreq_get_rate() does not check for this case, resulting in a NULL pointer dereference (NVD, Red Hat). The vulnerability has been assigned a CVSS v3.1 base score of 5.5, indicating moderate severity (Red Hat).

When successfully exploited, this vulnerability can lead to system crashes or denial of service conditions due to the NULL pointer dereference in the Linux kernel (Wiz).

The vulnerability has been resolved by adding a NULL check after cpufreq_cpu_get_raw() to prevent the NULL pointer dereference. This fix has been implemented in the Linux kernel (NVD).