CVE-2025-37831: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37831 is a vulnerability discovered in the Linux kernel's cpufreq subsystem, specifically affecting the apple-soc driver. The vulnerability was disclosed on May 8, 2025, and impacts the CPU frequency scaling functionality for Apple Silicon processors (NVD, Wiz).

The vulnerability stems from a null pointer dereference in the apple_soc_cpufreq_get_rate() function. The issue occurs when cpufreq_cpu_get_raw() returns NULL in cases where the target CPU is not present in the policy->cpus mask. The apple_soc_cpufreq_get_rate() function fails to properly check for this NULL return value before attempting to dereference the pointer (Wiz, NVD).

If successfully exploited, this vulnerability could result in a denial of service condition through a kernel crash when attempting to read CPU frequency information for non-existent CPU cores on Apple Silicon-based systems (Wiz).

The vulnerability has an Exploitation Probability Percentile (EPSS) of 2.9, and there are currently no known public exploits available. The vulnerability requires local access to the system (Wiz).

The vulnerability has been resolved in the Linux kernel through a patch that implements proper NULL pointer checking in the apple_soc_cpufreq_get_rate() function. Fixed versions are available in various Linux distributions, including Debian Bookworm (6.12.27-1) and Bullseye (Debian, Wiz).