Cloudanix VulnDB

CVE-2025-38295

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Jul 10, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in the Linux kernel driver for certain Amlogic chips can cause warning messages and possible instability when the system loads performance-monitoring components.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

The meson_ddr_pmu_create() function in the Amlogic DDR PMU driver calls smp_processor_id() without ensuring preemption is disabled, triggering kernel warnings and stack traces when the module loads in a preemptible context.

Why it matters to the business

Systems running affected Linux kernel versions on Amlogic hardware may experience repeated kernel warnings and potential instability during driver initialization or module loading, increasing operational overhead and complicating troubleshooting in production environments with high downstream kernel usage.

How an attack unfolds

An attacker with local access loads or triggers the affected Amlogic DDR PMU driver module (meson_ddr_pmu_g12), causing the preemptible-context violation during probe; while primarily producing warnings, the race-condition nature could be leveraged in combination with other kernel flaws for privilege escalation in campaigns involving Linux kernel issues.

How to fix it

Update to fixed kernel versions: linux-lts (Alpaquita:23) 6.1.56-r0, linux-lts (Alpaquita:stream) 6.6.58-r0, or mainline commit 77511c2d2d1cbce8d9b4f50849843dd469d14173; rebuild and deploy the updated kernel, then verify module loading succeeds without warnings.

How to confirm the fix worked

After patching, load the driver module and confirm absence of 'BUG: using smp_processor_id() in preemptible' messages in dmesg; check kernel version against the listed fixed releases.

Typical attack path

  1. Obtain local user access on affected Amlogic-based Linux system
  2. Trigger loading of the meson_ddr_pmu_g12 module via udev or manual insmod
  3. Driver probe calls meson_ddr_pmu_create() in preemptible context
  4. smp_processor_id() usage generates BUG warning and stack trace

How to detect it

Search kernel logs and dmesg for strings indicating smp_processor_id() usage in preemptible code during meson_ddr_pmu or g12_ddr_pmu_probe initialization; correlate with udev-worker or module load events on Amlogic hardware.

  • BUG: using smp_processor_id() in preemptible
  • meson_ddr_pmu_create+0x200/0x560
  • g12_ddr_pmu_probe+0x20/0x38
  • meson_ddr_pmu_g12

What your security team should do

  • Prioritize patching Amlogic-based systems within 30 days given EPSS increase and Linux kernel prevalence
  • Monitor dmesg and kernel logs for preemption-related warnings during module loads
  • Test updated kernels in staging before broad deployment to avoid boot or probe regressions

The record

In the Linux kernel, the following vulnerability has been resolved: perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() The Amlogic DDR PMU driver meson_ddr_pmu_create() function incorrectly uses smp_processor_id(), which assumes disabled preemption. This leads to kernel warnings during module loading because meson_ddr_pmu_create() can be called in a preemptible context. Following kernel warning and stack trace: [ 31.745138] [ T2289] BUG: using smp_processor_id() in preemptible [00000000] code: (udev-worker)/2289 [ 31.745154] [ T2289] caller is debug_smp_processor_id+0x28/0x38 [ 31.745172] [ T2289] CPU: 4 UID: 0 PID: 2289 Comm: (udev-worker) Tainted: GW 6.14.0-0-MANJARO-ARM #1 59519addcbca6ba8de735e151fd7b9e97aac7ff0 [ 31.745181] [ T2289] Tainted: [W]=WARN [ 31.745183] [ T2289] Hardware name: Hardkernel ODROID-N2Plus (DT) [ 31.745188] [ T2289] Call trace: [ 31.745191] [ T2289] show_stack+0x28/0x40 (C) [ 31.745199] [ T2289] dump_stack_lvl+0x4c/0x198 [ 31.745205] [ T2289] dump_stack+0x20/0x50 [ 31.745209] [ T2289] check_preemption_disabled+0xec/0xf0 [ 31.745213] [ T2289] debug_smp_processor_id+0x28/0x38 [ 31.745216] [ T2289] meson_ddr_pmu_create+0x200/0x560 [meson_ddr_pmu_g12 8095101c49676ad138d9961e3eddaee10acca7bd] [ 31.745237] [ T2289] g12_ddr_pmu_probe+0x20/0x38 [meson_ddr_pmu_g12 8095101c49676ad138d9961e3eddaee10acca7bd] [ 31.745246] [ T2289] platform_probe+0x98/0xe0 [ 31.745254] [ T2289] really_probe+0x144/0x3f8 [ 31.745258] [ T2289] __driver_probe_device+0xb8/0x180 [ 31.745261] [ T2289] driver_probe_device+0x54/0x268 [ 31.745264] [ T2289] __driver_attach+0x11c/0x288 [ 31.745267] [ T2289] bus_for_each_dev+0xfc/0x160 [ 31.745274] [ T2289] driver_attach+0x34/0x50 [ 31.745277] [ T2289] bus_add_driver+0x160/0x2b0 [ 31.745281] [ T2289] driver_register+0x78/0x120 [ 31.745285] [ T2289] __platform_driver_register+0x30/0x48 [ 31.745288] [ T2289] init_module+0x30/0xfe0 [meson_ddr_pmu_g12 8095101c49676ad138d9961e3eddaee10acca7bd] [ 31.745298] [ T2289] do_one_initcall+0x11c/0x438 [ 31.745303] [ T2289] do_init_module+0x68/0x228 [ 31.745311] [ T2289] load_module+0x118c/0x13a8 [ 31.745315] [ T2289] __arm64_sys_finit_module+0x274/0x390 [ 31.745320] [ T2289] invoke_syscall+0x74/0x108 [ 31.745326] [ T2289] el0_svc_common+0x90/0xf8 [ 31.745330] [ T2289] do_el0_svc+0x2c/0x48 [ 31.745333] [ T2289] el0_svc+0x60/0x150 [ 31.745337] [ T2289] el0t_64_sync_handler+0x80/0x118 [ 31.745341] [ T2289] el0t_64_sync+0x1b8/0x1c0 Changes replaces smp_processor_id() with raw_smp_processor_id() to ensure safe CPU ID retrieval in preemptible contexts.

Affected packages

Ecosystem Package Introduced Fixed
Debian:13 linux 0 6.12.35-1
Linux Kernel 6.2.0 6.6.94
Mageia:9 kernel 0 6.6.101-1.mga9
Mageia:9 kernel-linus 0 6.6.101-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.10-7.mga9
Mageia:9 kmod-xtables-addons 0 3.24-83.mga9
Mageia:9 wireless-regdb 0 20250710-1.mga9

Related vulnerabilities