CVE-2025-40346: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40346 is a NULL pointer dereference vulnerability in the Linux kernel's arch_topology subsystem, specifically within the topology_parse_cpu_capacity() function. The flaw stems from incorrect use of PTR_ERR_OR_ZERO() instead of IS_ERR_OR_NULL() when checking the return value of of_clk_get(), allowing the code to proceed with a NULL clock pointer and subsequently call clk_get_rate(NULL). The vulnerability was published on December 16, 2025, and affects Linux kernel versions from the introduction of commit b8fe128dad8f97cc9af7c55a264d1fc5ab677195 up to the respective fix commits across multiple stable branches. No CVSS base score has been assigned at this time (Feedly, CVE Record).

The root cause is an incorrect error-checking idiom (CWE-476: NULL Pointer Dereference). The function topology_parse_cpu_capacity() uses !PTR_ERR_OR_ZERO(cpu_clk) to determine whether to proceed with the clock pointer; however, PTR_ERR_OR_ZERO() returns 0 for both valid pointers and NULL pointers, meaning the condition evaluates to true in both cases. When of_clk_get() returns NULL (e.g., when a CPU clock is not defined in the device tree), the code incorrectly proceeds to call clk_get_rate(NULL), which can trigger a NULL pointer dereference. The fix replaces the check with !IS_ERR_OR_NULL(cpu_clk), which correctly distinguishes valid pointers from both error pointers and NULL (Feedly).

Successful triggering of this vulnerability can cause a kernel NULL pointer dereference, leading to a kernel panic or system crash, which constitutes a denial-of-service condition. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. The vulnerability is most likely to manifest on systems where CPU clock information is absent or incomplete in the device tree, such as certain ARM/ARM64 embedded or SoC-based platforms (Feedly).

There is no known public exploit code, proof-of-concept, or evidence of in-the-wild exploitation for CVE-2025-40346. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require the ability to influence kernel boot conditions or device tree configuration, limiting practical attack surface (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include: 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.17.6, and 6.18. AWS Amazon Linux 2 kernel packages have also been updated (ALAS2KERNEL-5.15-2025-094 and ALAS2KERNEL-5.10-2026-112). Users should update to the patched kernel version applicable to their distribution as soon as possible. No configuration-based workaround is available; patching is the only remediation (Feedly, AWS ALAS).