CVE-2025-38296

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: platform_profile: Avoid initializing on non-ACPI platforms

The platform profile driver is loaded even on platforms that do not have

ACPI enabled. The initialization of the sysfs entries was recently moved

from platform_profile_register() to the module init call, and those

entries need acpi_kobj to be initialized which is not the case when ACPI

is disabled.

This results in the following warning:

WARNING: CPU: 5 PID: 1 at fs/sysfs/group.c:131 internal_create_group+0xa22/0xdd8

Modules linked in:

CPU: 5 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.15.0-rc7-dirty #6 PREEMPT

Tainted: [W]=WARN

Hardware name: riscv-virtio,qemu (DT)

epc : internal_create_group+0xa22/0xdd8

ra : internal_create_group+0xa22/0xdd8

Call Trace:

internal_create_group+0xa22/0xdd8

sysfs_create_group+0x22/0x2e

platform_profile_init+0x74/0xb2

do_one_initcall+0x198/0xa9e

kernel_init_freeable+0x6d8/0x780

kernel_in

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References