Critical Vulnerability in Linux Kernel: Driver Lock Issue in cpufreq AMD Pstate
Summary
CVE-2025-38038: In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost set_boost is a per-policy function call, hence a driver wide lock is unnecessary. Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It manages system resources, including CPU scheduling, memory management, and device control. The cpufreq subsystem is responsible for managing CPU frequency scaling, allowing the system to adjust the CPU's speed based on workload. This vulnerability affects the AMD Pstate driver, which is part of the cpufreq subsystem, potentially leading to system instability due to improper locking mechanisms.
Vulnerability Detail
The vulnerability arises from an unnecessary driver-wide lock in the set_boost function within the AMD Pstate driver. Since set_boost is a per-policy function call, the use of a global lock is excessive and can lead to deadlocks when combined with other mutex acquisitions in the mode-switch path of the status_store function. This can result in system hangs or crashes, impacting overall system performance and reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-38038 vulnerability in the Linux kernel's AMD Pstate driver poses a significant risk due to potential deadlocks from unnecessary locking mechanisms. It is crucial to apply the available patches promptly to ensure system stability and security. Regular monitoring and updates are essential to protect against such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38038 is a vulnerability in the Linux kernel's AMD Pstate driver that can lead to deadlocks due to unnecessary driver-wide locks.
This vulnerability can cause system hangs or crashes, affecting the stability and performance of your operating system.
Yes, a patch is available for Debian 13 in version 6.12.32-1. It is recommended to update to this version to mitigate the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update immediately, ensure to monitor your system closely for any unusual behavior and plan for an update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
