CVE-2025-38407 is a vulnerability in the Linux kernel's RISC-V architecture support related to the handling of per-CPU boot data when NUMA is enabled. The issue arises because the function sbi_hsm_hart_start() assumes a physical address translation that is invalid when percpu data is allocated in the vmalloc area, causing secondary CPUs (harts) to hang during boot. This was fixed by changing the boot_data allocation to a static array within the kernel image, preventing invalid address access and enabling successful SMP boot on affected hardware.