CVE-2025-38113

What it actually does

NULL pointer dereference in cppc_allow_fast_switch during for_each_possible_cpu iteration when nosmp boot parameter leaves secondary CPU cpc_desc_ptr uninitialized, triggering kernel panic at init.

Why it matters to the business

Systems using the nosmp boot option experience immediate boot failure and kernel panic, resulting in operational downtime; high prevalence in Linux ecosystems increases exposure for affected distributions and downstream packages.

How an attack unfolds

An attacker supplies the nosmp kernel command line parameter to prevent secondary CPU bring-up, causing CPU0 to dereference NULL cpc_desc_ptr entries in ACPI CPPC fast-switch logic during early boot and crash the kernel; listed threat actors in Linux privilege-escalation campaigns may combine this with boot-parameter manipulation for denial of service.

How to fix it

Upgrade to fixed kernel commit 356d09c7f5bf525086002a34f8bae40b134d1611 or later; for spire-controller-manager packages update to 0.6.2-r1 or newer on Chainguard and Wolfi distributions.

How to confirm the fix worked

Confirm kernel version contains commit 356d09c7f5bf525086002a34f8bae40b134d1611; boot with nosmp and verify no NULL dereference panic occurs in cppc_allow_fast_switch.

Typical attack path

1. Gain ability to influence kernel command line (local access, bootloader compromise, or cloud instance metadata).
2. Append nosmp to cmdline and reboot.
3. Kernel executes cppc_allow_fast_switch on CPU0, hits NULL dereference, and panics.

How to detect it

Search kernel logs and boot logs for NULL pointer dereference at cppc_allow_fast_switch+0x6a and panic messages mentioning Attempted to kill init; correlate with presence of nosmp in /proc/cmdline or bootloader configs.

• cppc_allow_fast_switch+0x6a
• Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b8
• Kernel panic - not syncing: Attempted to kill init!
• nosmp

What your security team should do

• Prioritize kernel upgrades on all systems that may use nosmp or similar restricted-CPU boot configurations.
• Audit bootloader configurations and instance metadata for unauthorized nosmp parameters.
• Monitor for kernel panics referencing cppc_allow_fast_switch and schedule testing of fixed versions within 30 days given EPSS trend.