CVE-2025-38113: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38113 is a NULL pointer dereference vulnerability in the Linux kernel's ACPI CPPC (Collaborative Processor Performance Control) subsystem. When the nosmp kernel command-line parameter is used, secondary CPUs are not brought up, leaving their cpc_desc_ptr pointers as NULL. CPU0's iteration via for_each_possible_cpu() in the cppc_allow_fast_switch() function then dereferences these NULL pointers, triggering a kernel panic. The vulnerability was published on July 3, 2025, and affects Linux kernel versions from 5.19 through multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). When the nosmp boot parameter is passed, the kernel skips initialization of secondary CPUs, leaving their cpc_desc_ptr fields uninitialized (NULL) in the ACPI CPPC descriptor table. During CPU0's execution of cppc_allow_fast_switch(), the function iterates over all possible CPUs using for_each_possible_cpu() without first checking whether each CPU's cpc_desc_ptr is non-NULL before dereferencing it at offset 0xb8. This causes an immediate kernel panic with the message "Attempted to kill init!", as shown in the panic backtrace at cppc_allow_fast_switch+0x6a/0xd4. The attack vector is local (AV:L) with low complexity and low privilege requirements (Red Hat CVE).

Successful triggering of this vulnerability results in a complete kernel panic, causing an immediate and unrecoverable system crash (denial of service). The impact is limited to availability — there is no confidentiality or integrity impact. Systems configured to boot with the nosmp parameter are rendered unbootable or subject to unexpected halts, which could affect critical infrastructure or single-CPU-mode testing environments (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access and the ability to influence kernel boot parameters (e.g., modifying the bootloader configuration), which limits the practical attack surface.

• Logs: Kernel panic messages in system logs or serial console output containing Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b8 and a backtrace referencing cppc_allow_fast_switch+0x6a/0xd4.
• Logs: Kernel log entry Kernel panic - not syncing: Attempted to kill init! shortly after boot on systems using the nosmp kernel parameter.
• System Behavior: System fails to complete boot or crashes immediately after ACPI CPPC initialization when nosmp is present in the kernel command line (verifiable via /proc/cmdline on systems that do boot).

Patches have been released for all affected stable kernel branches: upgrade to kernel 6.1.142+, 6.6.94+, 6.12.34+, or 6.15.3+ (or 6.16-rc2+) to resolve the issue (Red Hat CVE). Distribution-specific updates are available from Debian (DSA-5973-1, DLA-4328-1), Ubuntu (USN-7769-1, USN-7769-2, USN-7769-3, USN-7770-1, USN-7789-2), SUSE, openSUSE, and Oracle Linux. As an immediate workaround, avoid using the nosmp boot parameter on affected kernel versions. Systems that require single-CPU operation should apply the kernel patch from the official stable tree before enabling nosmp.