CVE-2025-40226: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40226 is a NULL pointer dereference vulnerability in the Linux kernel's ARM SCMI (System Control and Management Interface) firmware subsystem. When the SCMI debug subsystem fails to initialize, the related debug root is missing and its underlying descriptor is NULL; the SCMI debug helper functions that maintain metrics counters do not account for this condition, potentially leading to a kernel fault. The vulnerability was published on December 4, 2025, and affects Linux kernel versions prior to the patched releases (6.6.115, 6.12.56, 6.17.6, and 6.18) (Feedly, ENISA EUVD). No CVSS score has been officially assigned at this time.

The root cause is a missing NULL pointer check (CWE-476) in the SCMI debug helper functions responsible for updating metrics counters. When the SCMI debug subsystem initialization fails — for example, due to resource constraints or configuration errors — the debug root descriptor is set to NULL. Subsequent calls to the metrics-counter helpers dereference this NULL pointer without validation, which can trigger a kernel NULL pointer dereference. The vulnerability is local in nature, requiring the affected kernel code path to be exercised on a system using ARM SCMI firmware interfaces (Feedly, ENISA EUVD).

Successful triggering of this vulnerability can cause a kernel panic or system crash (denial of service) on affected Linux systems using ARM SCMI firmware interfaces. Because the flaw resides in kernel space, there is no direct path to privilege escalation or data exfiltration in typical exploitation scenarios; the primary impact is availability loss. Systems relying on ARM SCMI for power and clock management — common in embedded and server-on-chip platforms — are most at risk (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-40226. The EPSS score is approximately 0.023% (0.000230), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access or the ability to trigger the specific SCMI debug initialization failure path.

The Linux kernel maintainers have released patches addressing this vulnerability in stable branches. Fixed versions include Linux 6.6.115, 6.12.56, 6.17.6, and 6.18. Users should update their kernel to one of these patched versions. The fix adds NULL pointer checks in the SCMI debug helper functions before dereferencing the debug root descriptor (ENISA EUVD, Kernel Stable). As a temporary workaround on systems where SCMI debug is not required, disabling SCMI debug at build time (if feasible) may reduce exposure.