CVE-2025-38407

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 6.16.0-rc1

Description A flaw was discovered in the RISC-V architecture of the Linux kernel related to the handling of SBI (Standardized Boot Interface) and per-CPU data allocation when NUMA (Non-Uniform Memory Access) is enabled. Specifically, the pa() function was incorrectly used to obtain the physical address of sbi hart boot data in the sbi hsm hart start() function, leading to access of an invalid address and a system hang on newly started CPU cores. This issue was triggered when the per-CPU allocator used the vmalloc area. The fix involves allocating a static array for boot data within the kernel image.

Recommendations Update to Linux Kernel version 6.16.0-rc1 or later.