LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38610: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()

In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_device() to return NULL, which propagates through em_cpu_get() and leads to a crash when em_span_cpus() dereferences the NULL pointer. Add a NULL check after em_cpu_get() and return 0 if unavailable, matching the existing fallback behavior in __dtpm_cpu_setup(). [ rjw: Drop an excess empty code line ]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-38610 is a Linux kernel reliability flaw in the powercap DTPM CPU code. Under a runtime CPU state change, the kernel can dereference a NULL pointer and crash. The source bundle does not show data theft, privilege escalation, remote exploitation, or confirmed active abuse.

Executive priority

Treat this as an availability-risk kernel maintenance item, not an emergency remote compromise based on current evidence. Patch through normal or accelerated kernel update cycles for critical Linux infrastructure, especially where an unexpected kernel crash would cause business disruption.

Technical view

get_pd_power_uw() may call em_span_cpus() after em_cpu_get() returns NULL. This can happen when get_cpu_device() returns NULL for a CPU that becomes impossible during runtime. The upstream fix adds a NULL check and returns 0, matching existing fallback behavior in __dtpm_cpu_setup().

Likely exposure

Exposure is limited to Linux systems running affected kernel versions or downstream builds containing the vulnerable powercap dtpm_cpu code. Systems using vendor kernels should be checked against their vendor advisories and kernel changelogs, because the source bundle does not map every distribution package version.

Exploitation context

The bundle reports no KEV listing and provides no evidence of active exploitation. Based on the described bug, the known impact is a kernel crash from a NULL pointer dereference. The triggering conditions appear tied to CPU runtime state changes, but attack prerequisites are not established in the provided sources.

Researcher notes

The root issue is missing NULL handling after em_cpu_get(). The fix returns 0 when energy model data is unavailable. Public data lacks CVSS, CWE, complete distro mapping, and exploitability detail, so validation should focus on kernel lineage and vendor backports rather than exploit reproduction.

Mitigation direction

  • Update to a kernel build containing the referenced stable fix.
  • Check Linux distribution advisories for backported package versions.
  • Prioritize critical hosts where kernel crashes affect availability.
  • Track Debian LTS guidance if using Debian LTS kernels.
  • Avoid assuming mitigation details beyond vendor guidance.

Validation and detection

  • Inventory Linux kernel versions across affected fleets.
  • Compare deployed kernels with vendor advisories and stable commit references.
  • Check whether powercap DTPM CPU code is present in deployed builds.
  • Review kernel logs for related NULL pointer dereference crashes.
  • Confirm patched kernels are running after maintenance windows.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38610 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxeb82bace893169b319c563b7f813c58a0a5a9f76, eb82bace893169b319c563b7f813c58a0a5a9f76, eb82bace893169b319c563b7f813c58a0a5a9f76, eb82bace893169b319c563b7f813c58a0a5a9f76, eb82bace893169b319c563b7f813c58a0a5a9f76, eb82bace893169b319c563b7f813c58a0a5a9f76unaffected
LinuxLinux5.16, 0, 6.1.148, 6.6.102, 6.12.42, 6.15.10, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.