CVE-2025-38407

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

riscv: cpu_ops_sbi: Use static array for boot_data

Since commit 6b9f29b81b15 ("riscv: Enable pcpu page first chunk

allocator"), if NUMA is enabled, the page percpu allocator may be used

on very sparse configurations, or when requested on boot with

percpu_alloc=page.

In that case, percpu data gets put in the vmalloc area. However,

sbi_hsm_hart_start() needs the physical address of a sbi_hart_boot_data,

and simply assumes that __pa() would work. This causes the just started

hart to immediately access an invalid address and hang.

Fortunately, struct sbi_hart_boot_data is not too large, so we can

simply allocate an array for boot_data statically, putting it in the

kernel image.

This fixes NUMA=y SMP boot on Sophgo SG2042.

To reproduce on QEMU: Set CONFIG_NUMA=y and CONFIG_DEBUG_VIRTUAL=y, then

run with:

qemu-system-riscv64 -M virt -smp 2 -nographic \

-kernel arch/riscv/boot/Image \

-append "percpu_alloc=pa

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References