CVE-2025-40352: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40352 is a kernel warning/bug in the Linux kernel's platform/mellanox: mlxbf-pmc driver, where the sysfs_attr_init() function is not called during initialization of the count_clock data structure. This omission triggers a lockdep warning (BUG: key has not been registered) when the BlueField-3 SoC is booted with CONFIG_LOCK_STAT enabled. The vulnerability was published on December 16, 2025, and affects Linux kernel versions from commit 5efc800975d9a66cf7e7684c07d4c1928f025972 up to (but not including) the fix commits. The CVSS base score is 0.0 (no severity rating assigned), reflecting its nature as a kernel debug warning rather than a directly exploitable security flaw (Feedly, ENISA EUVD).

The root cause is a missing call to sysfs_attr_init() in the mlxbf_pmc driver's initialization path for the count_clock sysfs attribute (CWE classification not formally assigned). When the driver registers the hardware monitor device via devm_hwmon_device_register_with_groups(), the kernel's lockdep subsystem detects that the lock key embedded in the sysfs attribute has not been properly registered, producing a DEBUG_LOCKS_WARN_ON(1) warning. The call trace shows the issue originates in mlxbf_pmc_probe() → __hwmon_device_register() → sysfs_create_groups() → lockdep_init_map_type(). The fix requires adding sysfs_attr_init() to the count_clock structure initialization before the attribute is registered with the sysfs subsystem (Feedly).

The practical impact of this vulnerability is limited to triggering a kernel warning message on systems running the BlueField-3 SoC with lock debugging (CONFIG_LOCK_STAT) enabled. There is no evidence of confidentiality, integrity, or availability impact beyond the diagnostic warning, and the issue does not enable privilege escalation, code execution, or data exposure. The affected scope is restricted to Mellanox BlueField-3 platforms running affected Linux kernel versions with debug configurations (Feedly, ENISA EUVD).

There is no known exploitation of CVE-2025-40352 in the wild, and no public proof-of-concept exploit exists. The EPSS score is 0.000180 (very low probability of exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue is a kernel debug warning rather than an exploitable security vulnerability, making weaponization highly unlikely (Feedly).

The fix is included in Linux kernel patch releases 6.17.6 and 6.18, which add the required sysfs_attr_init() call to the count_clock data structure initialization in the mlxbf_pmc driver. The relevant fix commits are 46be1f5aae82b4136f676528ff091629697c7719 and a7b4747d8e0e7871c3d4971cded1dcc9af6af9e9 in the stable kernel tree. Administrators running BlueField-3 SoC systems should update to kernel 6.17.6 or 6.18 or later; as a workaround, disabling CONFIG_LOCK_STAT in the kernel configuration will suppress the warning but is not recommended for production debug environments (Feedly, ENISA EUVD).