Kernel Vulnerability in Linux Package: Fix for smp_processor_id() Call Trace in Preemptible Kernels
Summary
DEBIAN-CVE-2025-38288: In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels Correct kernel call trace when calling smp_processor_id() when called in preem... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the smartpqi driver within the kernel, which is responsible for managing SCSI devices. The issue arises when the smp_processor_id() function is called in preemptible contexts, leading to potential system instability and erroneous behavior.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the smartpqi SCSI driver related to the improper use of the smp_processor_id() function in preemptible kernels. When this function is invoked while preemption is enabled, it triggers an error message and a stack trace dump, which can lead to system performance degradation and instability. The vulnerability is rooted in the kernel's handling of processor identification during preemption, which can cause unexpected behavior in multi-threaded environments. This issue could potentially allow for denial-of-service conditions or other unintended consequences in systems relying on the affected driver.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to ensure system stability and security.
Conclusion
The vulnerability identified in the Linux kernel regarding the smp_processor_id() function poses significant risks to system stability in preemptible kernels. Users are strongly advised to update to the patched version to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves the improper use of the smp_processor_id() function in preemptible kernels, which can lead to system instability.
The vulnerability affects the Linux package versions prior to 6.12.35-1 in both Debian 13 and Debian 14.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is crucial to plan for an update to the patched version as soon as possible to mitigate risks.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38288.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
