CVE-2025-38407: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38407 is a vulnerability in the Linux kernel's RISC-V architecture affecting the SBI (Supervisor Binary Interface) CPU operations during hart (hardware thread) startup. When NUMA is enabled and the percpu page allocator is used (placing percpu data in the vmalloc area), sbi_hsm_hart_start() incorrectly assumes __pa() can translate the virtual address of sbi_hart_boot_data to a physical address, causing secondary CPUs to access an invalid address and hang. Affected kernel versions include 6.8 through 6.12.36 and 6.13 through 6.15.5, as well as release candidates 6.16-rc1 through 6.16-rc4. The vulnerability was published on July 25, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an improper physical address translation (CWE-119/incorrect memory handling) introduced after commit 6b9f29b81b15 ("riscv: Enable pcpu page first chunk allocator"). When CONFIG_NUMA=y is set and the page percpu allocator is active (either automatically on sparse NUMA configurations or via the percpu_alloc=page boot parameter), percpu data is placed in the vmalloc area rather than the linear kernel mapping. The sbi_hsm_hart_start() function then calls __pa() on a vmalloc address for sbi_hart_boot_data, which is only valid for linearly-mapped addresses — resulting in an invalid physical address being passed to the newly started hart. The fix replaces the percpu allocation with a statically allocated array in the kernel image, ensuring __pa() always operates on a linearly-mapped address (Red Hat Bugzilla, Red Hat Advisory).

Exploitation of this vulnerability results in a denial of service: secondary CPUs fail to come online during SMP boot on NUMA-enabled RISC-V systems, causing the system to boot with reduced CPU count or fail to boot entirely. The impact is limited to availability (CVSS availability impact: High), with no confidentiality or integrity impact. Real-world impact is primarily observed on Sophgo SG2042 hardware and reproducible on QEMU with CONFIG_NUMA=y and percpu_alloc=page (Red Hat Bugzilla, Red Hat Advisory).

There is no known public proof-of-concept exploit, and no evidence of in-the-wild exploitation has been reported. The vulnerability requires local access and low privileges (CVSS: AV:L/AC:L/PR:L), and is only triggered under specific hardware/configuration conditions (NUMA-enabled RISC-V systems with page percpu allocation). The EPSS score is 0.017% (0.000170), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat Advisory, Red Hat Bugzilla).

Update to a patched Linux kernel version: 6.12.37 or later, or 6.15.6 or later. Patches are available via the upstream kernel stable tree (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3). As a temporary workaround on unpatched systems, avoid using percpu_alloc=page as a kernel boot parameter on NUMA-enabled RISC-V configurations. Ubuntu has also issued a security notice (USN-7834-1) addressing this vulnerability (Red Hat Advisory).

Red Hat tracked the issue via Bugzilla (Bug 2383434) and published a CVE advisory. Ubuntu issued security notice USN-7834-1 covering this vulnerability. No significant broader community discussion or media coverage has been identified beyond standard vulnerability tracking (Red Hat Bugzilla, Ubuntu Advisory).