Kernel Panic Vulnerability in Linux Packages: CVE-2025-38113
Summary
CVE-2025-38113: In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Fix NULL pointer dereference when nosmp is used With nosmp in cmdline, other CPUs are not brought up, leaving their cpc_desc_ptr NULL. Affects linux versions < 6.1.147-1. Fixed in 6.1.147-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used across various distributions, including Debian. This vulnerability arises from a specific configuration option (nosmp) that can lead to system instability and crashes, particularly affecting systems that rely on multi-core processors.
Vulnerability Detail
CVE-2025-38113 is a vulnerability in the Linux kernel that occurs when the 'nosmp' option is used in the command line. This option prevents other CPUs from being activated, resulting in a NULL pointer dereference when the kernel attempts to iterate over available CPUs. The panic occurs due to the kernel trying to access a NULL pointer, leading to a system crash. The panic backtrace indicates that the issue arises in the cppc_allow_fast_switch function, which is critical for CPU performance management. This vulnerability can cause significant disruptions, especially in production environments where system uptime is crucial.
How To Fix
Minimum fixed version
6.1.147-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'nosmp' option in the kernel command line to prevent the NULL pointer dereference. This change can help maintain system stability until the package is updated.
Conclusion
CVE-2025-38113 is a critical vulnerability affecting the Linux kernel that can lead to system crashes when the 'nosmp' option is used. It is essential for users to update their systems to the latest patched version to ensure stability and security. Temporary workarounds are available, but the best course of action is to apply the necessary updates.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38113 is a vulnerability in the Linux kernel that can cause a kernel panic when the 'nosmp' option is used, leading to system crashes.
If your system uses the 'nosmp' option, it may experience crashes and instability, particularly in multi-core environments.
Yes, a patch has been released for the affected Linux packages. Users should update their systems to the latest version to mitigate the risk.
As a temporary measure, avoid using the 'nosmp' option in your kernel command line to maintain system stability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just a manifest file like package-lock.json. You can also check if your application is affected by this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
