arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2025-40346
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-12-16 14:15:46 UTC
Updated2026-10-14 13:10:00 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() Fix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to potential NULL pointer dereference in clk_get_rate(). Per include/linux/err.h documentation, PTR_ERR_OR_ZERO(ptr) returns: "The error code within @ptr if it is an error pointer; 0 otherwise." This means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing clk_get_rate(NULL) to be called when of_clk_get() returns NULL. Replace with !IS_ERR_OR_NULL(cpu_clk) which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate().

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected b8fe128dad8f97cc9af7c55a264d1fc5ab677195 64da320252e43456cc9ec3055ff567f168467b37 git Not specified
CNA Linux Linux affected b8fe128dad8f97cc9af7c55a264d1fc5ab677195 02fbea0864fd4a863671f5d418129258d7159f68 git Not specified
CNA Linux Linux affected b8fe128dad8f97cc9af7c55a264d1fc5ab677195 a77f8434954cb1e9c42c3854e40855fdcf5ab235 git Not specified
CNA Linux Linux affected b8fe128dad8f97cc9af7c55a264d1fc5ab677195 3373f263bb647fcc3b5237cfaef757633b9ee25e git Not specified
CNA Linux Linux affected b8fe128dad8f97cc9af7c55a264d1fc5ab677195 45379303124487db3a81219af7565d41f498167f git Not specified
CNA Linux Linux affected b8fe128dad8f97cc9af7c55a264d1fc5ab677195 3a01b2614e84361aa222f67bc628593987e5cdb2 git Not specified
CNA Linux Linux affected b8fe128dad8f97cc9af7c55a264d1fc5ab677195 2eead19334516c8e9927c11b448fbe512b1f18a1 git Not specified
CNA Linux Linux affected 5.7 Not specified
CNA Linux Linux unaffected 5.7 semver Not specified
CNA Linux Linux unaffected 5.10.246 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.196 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.158 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.115 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.56 6.12.* semver Not specified
CNA Linux Linux unaffected 6.17.6 6.17.* semver Not specified
CNA Linux Linux unaffected 6.18 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/3373f263bb647fcc3b5237cfaef757633b9ee25e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/45379303124487db3a81219af7565d41f498167f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/64da320252e43456cc9ec3055ff567f168467b37 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a77f8434954cb1e9c42c3854e40855fdcf5ab235 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/02fbea0864fd4a863671f5d418129258d7159f68 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3a01b2614e84361aa222f67bc628593987e5cdb2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2eead19334516c8e9927c11b448fbe512b1f18a1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report