CVE-2025-37841 – This CVE describes a NULL pointer dereference v... (How to Fix)

📋 TL;DR

This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's cpupower benchmarking tool. If memory allocation fails, the system could crash or become unstable. This affects Linux systems using cpupower with insufficient memory.

💻 Affected Systems

Products:

Linux kernel cpupower utility

Versions: Linux kernel versions before the fix commits

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only exploitable when cpupower bench is executed with insufficient memory

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service

🟠

Likely Case

Application crash or system instability when cpupower bench runs with low memory

🟢

If Mitigated

Minor performance impact with proper memory management

🌐 Internet-Facing: LOW - cpupower is typically not exposed to external networks

🏢 Internal Only: MEDIUM - Requires local access or ability to trigger cpupower bench with low memory

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to run cpupower bench with controlled memory conditions

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel versions containing the fix commits

Vendor Advisory: https://git.kernel.org/stable/c/0e297a02e03dceb2874789ca40bd4e65c5371704

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version
2. Rebuild cpupower if compiled separately
3. Reboot system to load new kernel

🔧 Temporary Workarounds

Limit cpupower bench usage

linux

Restrict execution of cpupower bench to prevent triggering the vulnerability

chmod 700 /usr/bin/cpupower
setcap -r /usr/bin/cpupower

Ensure adequate memory

linux

Maintain sufficient system memory to prevent malloc failures

sysctl -w vm.min_free_kbytes=65536
echo 3 > /proc/sys/vm/drop_caches

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized users from running cpupower bench
Monitor system memory usage and ensure adequate free memory is always available

🔍 How to Verify

Check if Vulnerable:

Check kernel version and cpupower source for NULL check on malloc in bench module

Check Version:

uname -r && cpupower --version

Verify Fix Applied:

Verify kernel version includes fix commits or test cpupower bench under low memory conditions

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
cpupower crash logs
Out of memory errors

Network Indicators:

None - local vulnerability only

SIEM Query:

search 'kernel panic' OR 'cpupower' AND 'segmentation fault'

📊 Metadata

CVE ID: CVE-2025-37841

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.02% exploit probability (4.2th percentile)

Published: May 9, 2025

Last Updated: November 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-37841, you might also want to check these: