CVE-2025-40352
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mellanox | mlxbf_pmc | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the mlxbf_pmc driver in the Linux kernel, specifically related to the BlueField-3 SOC. The driver fails to call sysfs_attr_init() during the initialization of the 'count_clock' data structure, which causes a lock-related debug warning (CONFIG_LOCK_STAT) during boot. This warning indicates that a key has not been registered properly, which is a sign of improper lock initialization in the kernel's locking subsystem.
How can this vulnerability impact me? :
The impact of this vulnerability is primarily a kernel warning related to lock debugging, which may indicate improper lock initialization. While the description does not specify direct security consequences such as privilege escalation or denial of service, the warning could lead to instability or unexpected behavior during system boot on affected hardware (BlueField-3 SOC).
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing the kernel boot logs for the specific warning message: 'BUG: key ffff00008a3402a8 has not been registered!' along with DEBUG_LOCKS_WARN_ON(1) and related call traces involving mlxbf_pmc. You can check the kernel logs using commands such as 'dmesg | grep -i mlxbf_pmc' or 'journalctl -k | grep -i mlxbf_pmc' to find these warnings.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the mlxbf_pmc driver calls sysfs_attr_init() during the initialization of the 'count_clock' data structure. This fix prevents the lock-related debug warning. Applying the updated Linux kernel version that includes this fix is the recommended immediate step.