CVE-2025-38295: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability has been identified in the Linux kernel where the Amlogic DDR PMU driver's mesonddrpmucreate() function incorrectly uses smpprocessor_id(), which assumes disabled preemption. This vulnerability (CVE-2025-38295) was disclosed on July 10, 2025, affecting the Linux kernel's performance monitoring subsystem (NVD).

The vulnerability stems from the improper use of smpprocessorid() in the mesonddrpmu_create() function, which can be called in a preemptible context. This leads to kernel warnings during module loading because the function assumes disabled preemption when it shouldn't. The issue manifests as kernel warnings and stack traces when the module is loaded (Debian Tracker).

The vulnerability results in kernel warnings and potential system instability when loading the affected module. While the immediate impact appears to be limited to system warnings, it could potentially affect the reliability of performance monitoring on affected systems (NVD).

The vulnerability has been resolved by replacing smpprocessorid() with rawsmpprocessorid() in the mesonddrpmucreate() function to ensure safe CPU ID retrieval in preemptible contexts. Fixed versions are available in various Linux distributions, including Debian's bullseye (5.10.223-1), bookworm (6.1.137-1), and trixie (6.12.35-1) releases (Debian Tracker).