Null Pointer Dereference in Linux Kernel's cpufreq: scmi_cpufreq_get_rate() Vulnerability
Summary
CVE-2025-37830: In the Linux kernel, the following vulnerability has been resolved: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() cpufreq_cpu_get_raw() can return NULL when the target CPU is not present in the policy->cpu... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the system. The cpufreq subsystem is responsible for managing CPU frequency scaling, allowing the system to adjust the CPU speed based on workload. This vulnerability affects the cpufreq implementation in the Linux kernel, specifically in the scmi_cpufreq_get_rate() function, which can lead to system instability.
Vulnerability Detail
In the Linux kernel, the cpufreq_cpu_get_raw() function can return NULL when the target CPU is not present in the policy->cpus mask. The scmi_cpufreq_get_rate() function does not adequately check for this NULL return value, leading to a potential NULL pointer dereference. This vulnerability can cause a system crash or unexpected behavior, impacting system reliability and performance.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the cpufreq functionality on CPUs that are not present in the policy->cpus mask. However, this is not a permanent solution and updating the package is recommended.
Conclusion
The CVE-2025-37830 vulnerability in the Linux kernel's cpufreq subsystem poses a significant risk of system instability due to a NULL pointer dereference. Users are strongly advised to update their Linux packages to the latest version to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37830 is a vulnerability in the Linux kernel's cpufreq subsystem that can lead to a NULL pointer dereference, potentially causing system crashes.
This vulnerability can lead to unexpected behavior or crashes in the system, particularly when managing CPU frequency scaling.
If you are using a version of the Linux kernel in Debian 11, 12, or 13, your system may be affected. You can check for vulnerabilities using the Vulert playground.
The best way to protect your system is to update the Linux package to the latest patched version as soon as it becomes available.
Vulert is a tool that monitors and alerts users in real-time for open-source vulnerabilities in software, using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
