CVE-2025-38610 in Linux
Summary
by MITRE • 08/19/2025
In the Linux kernel, the following vulnerability has been resolved:
powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_device() to return NULL, which propagates through em_cpu_get() and leads to a crash when em_span_cpus() dereferences the NULL pointer.
Add a NULL check after em_cpu_get() and return 0 if unavailable, matching the existing fallback behavior in __dtpm_cpu_setup().
[ rjw: Drop an excess empty code line ]
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 01/21/2026
The vulnerability identified as CVE-2025-38610 represents a critical NULL pointer dereference issue within the Linux kernel's powercap subsystem, specifically affecting the dtpm_cpu driver component. This flaw exists in the get_pd_power_uw() function which handles power domain power measurements for CPU resources. The vulnerability stems from inadequate error handling when dealing with dynamic CPU topology changes during system runtime, creating a potential crash condition that could compromise system stability and availability. The issue manifests when the kernel attempts to process power measurements for CPUs that have become impossible or unavailable during operation, leading to a kernel panic through direct dereference of a NULL pointer.
The technical root cause of this vulnerability lies in the improper handling of CPU device retrieval within the energy model framework. When a CPU becomes impossible during runtime, the get_cpu_device() function returns NULL, which then propagates through the em_cpu_get() call chain. This NULL value eventually reaches the em_span_cpus() function which attempts to dereference the NULL pointer without proper validation, resulting in immediate system crash. The vulnerability specifically affects systems running Linux kernel versions where the powercap subsystem interfaces with energy models for CPU power monitoring and management. This represents a classic CWE-476 NULL pointer dereference issue that can be exploited to cause denial of service conditions.
The operational impact of CVE-2025-38610 extends beyond simple system crashes to potentially disrupt critical system operations in environments where dynamic CPU management is prevalent. Systems utilizing hot-plug CPU capabilities, power management features, or runtime CPU topology changes are particularly vulnerable to this condition. The vulnerability can be triggered through normal system operations when CPU resources become unavailable during active power monitoring, making it difficult to predict and prevent. This flaw directly impacts the ATT&CK technique T1490 for resource hijacking and can be leveraged by attackers to cause system instability, particularly in server environments where power management is critical. The vulnerability's exploitation requires minimal privileges and can be triggered through normal kernel operations, making it a significant concern for system administrators and security teams.
Mitigation strategies for CVE-2025-38610 focus on implementing proper NULL pointer validation within the powercap subsystem. The fix involves adding a NULL check immediately after the em_cpu_get() function call to prevent the propagation of NULL values to downstream functions. When em_cpu_get() returns NULL, the function should return zero as a fallback value, matching the existing behavior in __dtpm_cpu_setup() function. This approach ensures system stability by gracefully handling unavailable CPU resources rather than crashing the kernel. System administrators should prioritize applying kernel updates that contain this fix, particularly in production environments where power management and CPU hot-plugging capabilities are utilized. Additionally, monitoring systems should be configured to detect unusual power management behavior that might indicate this vulnerability's exploitation. The fix aligns with security best practices for kernel development and follows the principle of defensive programming to prevent similar NULL pointer dereference conditions in other kernel subsystems.