{"cve":"CVE-2025-40352","nvd":{"published":"2025-12-16T14:15:47.083","modified":"2026-10-14T13:10:00.187","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init\n\nThe lock-related debug logic (CONFIG_LOCK_STAT) in the kernel is noting\nthe following warning when the BlueField-3 SOC is booted:\n\n  BUG: key ffff00008a3402a8 has not been registered!\n  ------------[ cut here ]------------\n  DEBUG_LOCKS_WARN_ON(1)\n  WARNING: CPU: 4 PID: 592 at kernel/locking/lockdep.c:4801 lockdep_init_map_type+0x1d4/0x2a0\n<snip>\n  Call trace:\n   lockdep_init_map_type+0x1d4/0x2a0\n   __kernfs_create_file+0x84/0x140\n   sysfs_add_file_mode_ns+0xcc/0x1cc\n   internal_create_group+0x110/0x3d4\n   internal_create_groups.part.0+0x54/0xcc\n   sysfs_create_groups+0x24/0x40\n   device_add+0x6e8/0x93c\n   device_register+0x28/0x40\n   __hwmon_device_register+0x4b0/0x8a0\n   devm_hwmon_device_register_with_groups+0x7c/0xe0\n   mlxbf_pmc_probe+0x1e8/0x3e0 [mlxbf_pmc]\n   platform_probe+0x70/0x110\n\nThe mlxbf_pmc driver must call sysfs_attr_init() during the\ninitialization of the \"count_clock\" data structure to avoid\nthis warning.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/46be1f5aae82b4136f676528ff091629697c7719","https://git.kernel.org/stable/c/a7b4747d8e0e7871c3d4971cded1dcc9af6af9e9"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:17:07.138532058+00:00"},"epss":{"cve":"CVE-2025-40352","score":0.00207,"percentile":0.10675,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}