Null Pointer Dereference Vulnerability in Linux Kernel's cpufreq Module
Summary
DEBIAN-CVE-2025-37831: In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() cpufreq_cpu_get_raw() can return NULL when the target CPU is not present in the p... Affects linux versions < 6.12.27-1. Fixed in 6.12.27-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It manages system resources, including CPU, memory, and devices. The cpufreq module is responsible for adjusting the CPU frequency based on the system load, optimizing performance and power consumption. However, this module can be vulnerable to certain coding errors, such as null pointer dereferences, which can lead to system instability or crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the cpufreq module related to the apple-soc implementation. Specifically, the function apple_soc_cpufreq_get_rate() does not adequately check if the cpufreq_cpu_get_raw() function returns NULL when the target CPU is not present in the policy->cpus mask. This oversight can lead to a null pointer dereference, potentially causing a system crash or unexpected behavior when the CPU is not available. This vulnerability is critical as it affects the stability of systems relying on the affected kernel versions.
How To Fix
Minimum fixed version
6.12.27-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the latest version of the Linux kernel.
Conclusion
The identified null pointer dereference vulnerability in the Linux kernel's cpufreq module poses a significant risk to system stability. Users are strongly advised to update their Linux packages to the patched version 6.12.27-1 to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
A null pointer dereference occurs when a program attempts to access or modify memory at a location that is not valid, leading to crashes or unpredictable behavior.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
Failure to address this vulnerability may lead to system crashes, instability, and potential data loss, especially in environments relying on the affected kernel versions.
Yes, this vulnerability affects specific versions of the Linux kernel prior to the patched version 6.12.27-1.
Detailed information can be found in the Debian CVE database, which provides insights into the vulnerability's impact and resolution.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
