CVE-2025-38297
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-11-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-369 | The product divides a value by zero. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a potential division-by-zero error in the Linux kernel's em_compute_costs() function. It occurs because when the device is not a CPU type, a performance value is not initialized, leading to division by zero during cost calculations related to energy efficiency scheduling (EAS). The issue arises from missing checks for non-CPU devices before performing the division.
How can this vulnerability impact me? :
The impact of this vulnerability is limited to the energy efficiency calculations within the Linux kernel's EAS framework. Since the cost algorithm is only used for EAS energy efficiency calculations and not by other device drivers, the practical impact is likely limited to incorrect or failed energy efficiency computations, which could affect power management but not cause broader system failures or security breaches.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability does not directly affect compliance with common standards and regulations such as GDPR or HIPAA, as it relates to an internal kernel calculation error without direct impact on data privacy, security, or regulatory requirements.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch or update to the fixed version of the Linux kernel that includes the fix for the division-by-zero error in em_compute_costs(). Specifically, ensure that the _is_cpu_device(dev) check is implemented to prevent the division-by-zero issue in energy efficiency calculations.