SB2025070456 - NULL pointer dereference in Linux kernel acpi driver
Published: July 4, 2025
Security Bulletin ID
SB2025070456
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) NULL pointer dereference (CVE-ID: CVE-2025-38113)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the cppc_allow_fast_switch() function in drivers/acpi/cppc_acpi.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/15eece6c5b05e5f9db0711978c3e3b7f1a2cfe12
- https://git.kernel.org/stable/c/1a677d0ceb4a5d62117b711a8b2e0aee80d33015
- https://git.kernel.org/stable/c/32a48db4cf28ea087214c261da8476db218d08bd
- https://git.kernel.org/stable/c/356d09c7f5bf525086002a34f8bae40b134d1611
- https://git.kernel.org/stable/c/c6dad167aade4bf0bef9130f2f149f4249fc4ad0