What’s Vulnerable › Vulnerabilities

CVE-2025-40226: firmware: arm_scmi: Account for failed debug initialization

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-04 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Account for failed debug initialization When the SCMI debug subsystem fails to initialize, the related debug root will be missing, and the underlying descriptor will be NULL. Handle this fault condition in the SCMI debug helpers that maintain metrics counters.

Affected products

• Linux kernel: from 6.6.92 before 6.6.115; 6.12 — fixed in 6.18, 6.6.115

How to fix

Upgrade to a fixed version: Linux kernel 6.18, 6.6.115. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/2290ab43b9d8eafb8046387f10a8dfa2b030ba46
• https://git.kernel.org/stable/c/554c9d5c6c695aedaecfb4365c187102709397b0
• https://git.kernel.org/stable/c/d719ce9f286c439795cd2beee4c91f12b84bc5a0
• https://git.kernel.org/stable/c/e088efcd97cb7c7297d166bb52c3b87a29f6a0b1

Get alerted when CVE-2025-40226 or the next vulnerability affects your stack