Critical NULL Pointer Dereference Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2025-23137: In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update Check if policy is NULL before dereferencing it in amd_pstate_update. Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used across various platforms, including servers, desktops, and embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes, data loss, or unauthorized access.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the cpufreq/amd-pstate module, specifically in the amd_pstate_update function. This issue arises from a missing NULL pointer check, which could lead to dereferencing a NULL pointer. If exploited, this vulnerability may cause system instability or crashes, potentially allowing an attacker to execute arbitrary code or escalate privileges.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The identified NULL pointer dereference vulnerability in the Linux kernel poses significant risks to system stability and security. Users are strongly advised to update to the patched version 6.12.35-1 to protect their systems. Regular monitoring and prompt updates are essential to maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the amd_pstate_update function of the Linux kernel, which can lead to system crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Exploiting this vulnerability could lead to system instability, crashes, or unauthorized access to system resources.
Yes, the vulnerability has been patched in version 6.12.35-1 of the Linux kernel.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
