CVE-2025-40346

What it actually does

Incorrect use of PTR_ERR_OR_ZERO() on a clock pointer allows NULL values to reach clk_get_rate(), resulting in a NULL pointer dereference during CPU topology parsing in the Linux kernel.

Why it matters to the business

Systems may experience crashes or instability during boot or CPU initialization on affected Linux distributions, potentially causing downtime; low exploitability reduces immediate risk but kernel-level flaws warrant priority patching.

How an attack unfolds

An attacker with local access or the ability to influence device tree/ACPI configuration triggers topology_parse_cpu_capacity() such that of_clk_get() returns NULL; the flawed error check then passes the NULL pointer to clk_get_rate(), causing a dereference that may lead to a kernel crash.

How to fix it

Upgrade the Linux kernel to a version containing commit 64da320252e43456cc9ec3055ff567f168467b37; for listed Red Hat packages apply python-virtualenv 15.1.0-4.el7_8 or later where applicable.

How to confirm the fix worked

Inspect the topology_parse_cpu_capacity() function to confirm replacement of PTR_ERR_OR_ZERO() with IS_ERR_OR_NULL(); verify kernel version or commit hash after update and test boot on affected hardware.

Typical attack path

1. Gain local execution or control device-tree content
2. Trigger CPU topology initialization code path
3. Force of_clk_get() to return NULL
4. Bypass flawed PTR_ERR_OR_ZERO() check
5. Invoke clk_get_rate(NULL) to dereference

How to detect it

Search kernel logs and crash dumps for oops or panic messages involving clk_get_rate or topology_parse_cpu_capacity; review dmesg output around boot time for NULL pointer dereferences in arch_topology.

What your security team should do

• Apply the referenced kernel commit or package updates within standard patch windows given low EPSS and absence from KEV
• Monitor kernel logs for NULL pointer dereference oops during topology parsing
• Include the affected kernel module in routine vulnerability scanning