CVE-2025-38296: ACPI: platform_profile: Avoid initializing on non-ACPI platforms
In the Linux kernel, the following vulnerability has been resolved:
ACPI: platformprofile: Avoid initializing on non-ACPI platforms
The platform profile driver is loaded even on platforms that do not have ACPI enabled. The initialization of the sysfs entries was recently moved from platformprofileregister() to the module init call, and those entries need acpikobj to be initialized which is not the case when ACPI is disabled.
This results in the following warning:
WARNING: CPU: 5 PID: 1 at fs/sysfs/group.c:131 internalcreategroup+0xa22/0xdd8 Modules linked in: CPU: 5 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.15.0-rc7-dirty #6 PREEMPT Tainted: [W]=WARN Hardware name: riscv-virtio,qemu (DT) epc : internalcreategroup+0xa22/0xdd8 ra : internalcreategroup+0xa22/0xdd8
Call Trace:
internalcreategroup+0xa22/0xdd8 sysfscreategroup+0x22/0x2e platformprofileinit+0x74/0xb2 dooneinitcall+0x198/0xa9e kernelinitfreeable+0x6d8/0x780 kernelinit+0x28/0x24c retfromfork+0xe/0x18
Fix this by checking if ACPI is enabled before trying to create sysfs entries.
[ rjw: Subject and changelog edits ]
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38296?
The severity of CVE-2025-38296 is considered low since it pertains to unnecessary initialization on non-ACPI platforms.
How do I fix CVE-2025-38296?
To fix CVE-2025-38296, update your Linux kernel to the latest version where the vulnerability has been addressed.
What systems are affected by CVE-2025-38296?
CVE-2025-38296 affects systems running the Linux kernel that initialize the platform profile driver on non-ACPI platforms.
Is there any risk if CVE-2025-38296 is not patched?
If CVE-2025-38296 is not patched, there will be no significant risks, as it primarily concerns unnecessary driver initialization.
When was CVE-2025-38296 disclosed?
CVE-2025-38296 was disclosed as part of a recent security patch to the Linux kernel.