Not yet scoredPublished Dec 4, 2025

CVE-2025-40226firmware: arm_scmi: Account for failed debug initialization

Updated under an hour ago (Oct 27, 2026, 6:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Account for failed debug initialization When the SCMI debug subsystem fails to initialize, the related debug root will be missing, and the underlying descriptor will be NULL. Handle this fault condition in the SCMI debug helpers that maintain metrics counters.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 23, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b38812942556819263256cb77fbdc9eae7aa5b1b before d719ce9f286c439795cd2beee4c91f12b84bc5a0; from 0b3d48c4726e1b20dffd2ff81a9d94d5d930220b before e088efcd97cb7c7297d166bb52c3b87a29f6a0b1; from 0b3d48c4726e1b20dffd2ff81a9d94d5d930220b before 554c9d5c6c695aedaecfb4365c187102709397b0; from 0b3d48c4726e1b20dffd2ff81a9d94d5d930220b before 2290ab43b9d8eafb8046387f10a8dfa2b030ba46; from 6.6.92 before 6.6.115	CNA record

References

References

https://git.kernel.org/stable/c/d719ce9f286c439795cd2beee4c91f12b84bc5a0
https://git.kernel.org/stable/c/e088efcd97cb7c7297d166bb52c3b87a29f6a0b1
https://git.kernel.org/stable/c/554c9d5c6c695aedaecfb4365c187102709397b0
https://git.kernel.org/stable/c/2290ab43b9d8eafb8046387f10a8dfa2b030ba46

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.