GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38141 (GCVE-0-2025-38141)

Vulnerability from cvelistv5 – Published: 2025-07-03 08:35 – Updated: 2026-08-05 11:59
VLAI
Title
dm: fix dm_blk_report_zones
Summary
In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this function. Only read it once, so that we are always using the same value. Otherwise we might miss a call to dm_put_live_table(). Finally, while md->zone_revalidate_map is set and a process is calling blk_revalidate_disk_zones() to set up the zone append emulation resources, it is possible that another process, perhaps triggered by blkdev_report_zones_ioctl(), will call dm_blk_report_zones(). If blk_revalidate_disk_zones() fails, these resources can be freed while the other process is still using them, causing a use-after-free error. blk_revalidate_disk_zones() will only ever be called when initially setting up the zone append emulation resources, such as when setting up a zoned dm-crypt table for the first time. Further table swaps will not set md->zone_revalidate_map or call blk_revalidate_disk_zones(). However it must be called using the new table (referenced by md->zone_revalidate_map) and the new queue limits while the DM device is suspended. dm_blk_report_zones() needs some way to distinguish between a call from blk_revalidate_disk_zones(), which must be allowed to use md->zone_revalidate_map to access this not yet activated table, and all other calls to dm_blk_report_zones(), which should not be allowed while the device is suspended and cannot use md->zone_revalidate_map, since the zone resources might be freed by the process currently calling blk_revalidate_disk_zones(). Solve this by tracking the process that sets md->zone_revalidate_map in dm_revalidate_zones() and only allowing that process to make use of it in dm_blk_report_zones().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:40 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f211268ed1f9bdf48f06a3ead5f5d88437450579 , < f9c1bdf24615303d48a2d0fd629c88f3189563aa (git)
Affected: f211268ed1f9bdf48f06a3ead5f5d88437450579 , < d19bc1b4dd5f322980b1f05f79b2ea4f0db10920 (git)
Affected: f211268ed1f9bdf48f06a3ead5f5d88437450579 , < 37f53a2c60d03743e0eacf7a0c01c279776fef4e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.34 , ≤ 6.12.* (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38141",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:19.111521Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T17:53:37.417Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-core.h",
            "drivers/md/dm-zone.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f9c1bdf24615303d48a2d0fd629c88f3189563aa",
              "status": "affected",
              "version": "f211268ed1f9bdf48f06a3ead5f5d88437450579",
              "versionType": "git"
            },
            {
              "lessThan": "d19bc1b4dd5f322980b1f05f79b2ea4f0db10920",
              "status": "affected",
              "version": "f211268ed1f9bdf48f06a3ead5f5d88437450579",
              "versionType": "git"
            },
            {
              "lessThan": "37f53a2c60d03743e0eacf7a0c01c279776fef4e",
              "status": "affected",
              "version": "f211268ed1f9bdf48f06a3ead5f5d88437450579",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-core.h",
            "drivers/md/dm-zone.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix dm_blk_report_zones\n\nIf dm_get_live_table() returned NULL, dm_put_live_table() was never\ncalled. Also, it is possible that md-\u003ezone_revalidate_map will change\nwhile calling this function. Only read it once, so that we are always\nusing the same value. Otherwise we might miss a call to\ndm_put_live_table().\n\nFinally, while md-\u003ezone_revalidate_map is set and a process is calling\nblk_revalidate_disk_zones() to set up the zone append emulation\nresources, it is possible that another process, perhaps triggered by\nblkdev_report_zones_ioctl(), will call dm_blk_report_zones(). If\nblk_revalidate_disk_zones() fails, these resources can be freed while\nthe other process is still using them, causing a use-after-free error.\n\nblk_revalidate_disk_zones() will only ever be called when initially\nsetting up the zone append emulation resources, such as when setting up\na zoned dm-crypt table for the first time. Further table swaps will not\nset md-\u003ezone_revalidate_map or call blk_revalidate_disk_zones().\nHowever it must be called using the new table (referenced by\nmd-\u003ezone_revalidate_map) and the new queue limits while the DM device is\nsuspended. dm_blk_report_zones() needs some way to distinguish between a\ncall from blk_revalidate_disk_zones(), which must be allowed to use\nmd-\u003ezone_revalidate_map to access this not yet activated table, and all\nother calls to dm_blk_report_zones(), which should not be allowed while\nthe device is suspended and cannot use md-\u003ezone_revalidate_map, since\nthe zone resources might be freed by the process currently calling\nblk_revalidate_disk_zones().\n\nSolve this by tracking the process that sets md-\u003ezone_revalidate_map in\ndm_revalidate_zones() and only allowing that process to make use of it\nin dm_blk_report_zones()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable function is reached through the BLKREPORTZONE/BLKREPORTZONEV2 ioctl on a device-mapper block device node (blkdev_common_ioctl \u2192 blkdev_report_zones_ioctl \u2192 blkdev_report_zones \u2192 dm_blk_report_zones), i.e. a local syscall on a local device file. No network or remote peer data is involved.\nAC:L - The attacker fully controls their side of the race and can spin the ioctl at thousands of calls per second, while the vulnerable window \u2014 a whole-device zone revalidation on an SMR/ZNS device plus the entire DM_TABLE_LOAD-to-resume gap where md-\u003emap is NULL \u2014 is wide and recurs on every zoned DM table setup, so no condition outside the attacker\u0027s influence has to fall into place.\nPR:L - BLKREPORTZONE is handled in blkdev_common_ioctl() with no capable() check and without requiring FMODE_WRITE, so any local user able to open the DM device read-only (disk-group member, container with the device exposed, or an unprivileged process on an embedded/Android zoned-storage system) can drive the ioctl loop.\nUI:N - The attacker only needs to loop on the ioctl; the zone revalidation and the loaded-but-unresumed table state occur automatically during normal device setup at boot, hotplug, or storage-daemon activity, with no victim action required.\nS:U - The use-after-free, out-of-bounds per-CPU increment, and hang are all confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A racing report walks a dm_table freed by dm_table_destroy() and zone resources freed by disk_free_zone_resources(), reading freed struct dm_target/dm_table contents and returning the resulting zone descriptors to userspace via blkdev_copy_zone_to_user(), and the SRCU counter imbalance from the garbage srcu_idx lets grace periods end early and expose further freed objects.\nI:H - dm_blk_do_report_zones() loads and calls tgt-\u003etype-\u003ereport_zones out of a freed dm_table, giving a control-flow hijack primitive once the slab is reclaimed, and srcu_read_unlock() with an uninitialized stack index performs an out-of-bounds this_cpu_inc() past srcu_ctrs[] into adjacent per-CPU memory.\nA:H - The missing dm_put_live_table() permanently leaks an SRCU read-side critical section, so every later synchronize_srcu(\u0026md-\u003eio_barrier) \u2014 table swap, suspend, or device removal \u2014 blocks forever in an unkillable D state while holding md-\u003esuspend_lock, wedging dmsetup; independently, the use-after-free on the freed table produces an oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:51.188Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f9c1bdf24615303d48a2d0fd629c88f3189563aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/d19bc1b4dd5f322980b1f05f79b2ea4f0db10920"
        },
        {
          "url": "https://git.kernel.org/stable/c/37f53a2c60d03743e0eacf7a0c01c279776fef4e"
        }
      ],
      "title": "dm: fix dm_blk_report_zones",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38141",
    "datePublished": "2025-07-03T08:35:42.787Z",
    "dateReserved": "2025-04-16T04:51:23.987Z",
    "dateUpdated": "2026-08-05T11:59:51.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38141",
      "date": "2026-09-16",
      "epss": "0.00169",
      "percentile": "0.06617"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38141\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T09:15:28.740\",\"lastModified\":\"2026-07-30T06:22:54.850\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm: fix dm_blk_report_zones\\n\\nIf dm_get_live_table() returned NULL, dm_put_live_table() was never\\ncalled. Also, it is possible that md-\u003ezone_revalidate_map will change\\nwhile calling this function. Only read it once, so that we are always\\nusing the same value. Otherwise we might miss a call to\\ndm_put_live_table().\\n\\nFinally, while md-\u003ezone_revalidate_map is set and a process is calling\\nblk_revalidate_disk_zones() to set up the zone append emulation\\nresources, it is possible that another process, perhaps triggered by\\nblkdev_report_zones_ioctl(), will call dm_blk_report_zones(). If\\nblk_revalidate_disk_zones() fails, these resources can be freed while\\nthe other process is still using them, causing a use-after-free error.\\n\\nblk_revalidate_disk_zones() will only ever be called when initially\\nsetting up the zone append emulation resources, such as when setting up\\na zoned dm-crypt table for the first time. Further table swaps will not\\nset md-\u003ezone_revalidate_map or call blk_revalidate_disk_zones().\\nHowever it must be called using the new table (referenced by\\nmd-\u003ezone_revalidate_map) and the new queue limits while the DM device is\\nsuspended. dm_blk_report_zones() needs some way to distinguish between a\\ncall from blk_revalidate_disk_zones(), which must be allowed to use\\nmd-\u003ezone_revalidate_map to access this not yet activated table, and all\\nother calls to dm_blk_report_zones(), which should not be allowed while\\nthe device is suspended and cannot use md-\u003ezone_revalidate_map, since\\nthe zone resources might be freed by the process currently calling\\nblk_revalidate_disk_zones().\\n\\nSolve this by tracking the process that sets md-\u003ezone_revalidate_map in\\ndm_revalidate_zones() and only allowing that process to make use of it\\nin dm_blk_report_zones().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm: fix dm_blk_report_zones Si dm_get_live_table() devolv\u00eda NULL, dm_put_live_table() nunca se llamaba. Adem\u00e1s, es posible que md-\u0026gt;zone_revalidate_map cambie al llamar a esta funci\u00f3n. Solo l\u00e9alo una vez, para que siempre usemos el mismo valor. De lo contrario, podr\u00edamos perder una llamada a dm_put_live_table(). Finalmente, mientras md-\u0026gt;zone_revalidate_map est\u00e1 configurado y un proceso est\u00e1 llamando a blk_revalidate_disk_zones() para configurar los recursos de emulaci\u00f3n de anexi\u00f3n de zona, es posible que otro proceso, quiz\u00e1s activado por blkdev_report_zones_ioctl(), llame a dm_blk_report_zones(). Si blk_revalidate_disk_zones() falla, estos recursos pueden liberarse mientras el otro proceso a\u00fan los est\u00e1 usando, causando un error de uso despu\u00e9s de liberaci\u00f3n. blk_revalidate_disk_zones() solo se llamar\u00e1 al configurar inicialmente los recursos de emulaci\u00f3n de anexi\u00f3n de zona, como al configurar una tabla dm-crypt zonificada por primera vez. Los intercambios de tabla posteriores no establecer\u00e1n md-\u0026gt;zone_revalidate_map ni llamar\u00e1n a blk_revalidate_disk_zones(). Sin embargo, debe llamarse utilizando la nueva tabla (referenciada por md-\u0026gt;zone_revalidate_map) y los nuevos l\u00edmites de cola mientras el dispositivo DM est\u00e9 suspendido. dm_blk_report_zones() necesita distinguir entre una llamada a blk_revalidate_disk_zones(), que debe permitir el uso de md-\u0026gt;zone_revalidate_map para acceder a esta tabla a\u00fan no activada, y todas las dem\u00e1s llamadas a dm_blk_report_zones(), que no deben permitirse mientras el dispositivo est\u00e9 suspendido y no puedan usar md-\u0026gt;zone_revalidate_map, ya que los recursos de la zona podr\u00edan ser liberados por el proceso que llama a blk_revalidate_disk_zones(). Para solucionar esto, se debe rastrear el proceso que establece md-\u0026gt;zone_revalidate_map en dm_revalidate_zones() y permitir que solo ese proceso lo use en dm_blk_report_zones().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/dm-core.h\",\"drivers/md/dm-zone.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f211268ed1f9bdf48f06a3ead5f5d88437450579\",\"lessThan\":\"f9c1bdf24615303d48a2d0fd629c88f3189563aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f211268ed1f9bdf48f06a3ead5f5d88437450579\",\"lessThan\":\"d19bc1b4dd5f322980b1f05f79b2ea4f0db10920\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f211268ed1f9bdf48f06a3ead5f5d88437450579\",\"lessThan\":\"37f53a2c60d03743e0eacf7a0c01c279776fef4e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/dm-core.h\",\"drivers/md/dm-zone.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.34\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:40:19.111521Z\",\"id\":\"CVE-2025-38141\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.12.34\",\"matchCriteriaId\":\"F6499D2B-1E57-44BB-866C-D74E63C32759\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"0541C761-BD5E-4C1A-8432-83B375D7EB92\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/37f53a2c60d03743e0eacf7a0c01c279776fef4e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d19bc1b4dd5f322980b1f05f79b2ea4f0db10920\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f9c1bdf24615303d48a2d0fd629c88f3189563aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:18:47+00:00",
      "cve": "CVE-2025-38141",
      "id": "CVE-2025-38141",
      "initial_release_date": "2025-07-03T00:00:00+00:00",
      "product_status:fixed": "1224",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38141.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-02T01:16:59Z",
      "cve": "CVE-2025-38141",
      "id": "CVE-2025-38141",
      "initial_release_date": "2025-07-03T23:23:08Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "555",
      "product_status:recommended": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38141",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38141.json",
      "version": "35"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-38141\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:40:19.111521Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:35:28.606Z\"}}], \"cna\": {\"title\": \"dm: fix dm_blk_report_zones\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f211268ed1f9bdf48f06a3ead5f5d88437450579\", \"lessThan\": \"f9c1bdf24615303d48a2d0fd629c88f3189563aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f211268ed1f9bdf48f06a3ead5f5d88437450579\", \"lessThan\": \"d19bc1b4dd5f322980b1f05f79b2ea4f0db10920\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f211268ed1f9bdf48f06a3ead5f5d88437450579\", \"lessThan\": \"37f53a2c60d03743e0eacf7a0c01c279776fef4e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/md/dm-core.h\", \"drivers/md/dm-zone.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.34\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.15.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/md/dm-core.h\", \"drivers/md/dm-zone.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f9c1bdf24615303d48a2d0fd629c88f3189563aa\"}, {\"url\": \"https://git.kernel.org/stable/c/d19bc1b4dd5f322980b1f05f79b2ea4f0db10920\"}, {\"url\": \"https://git.kernel.org/stable/c/37f53a2c60d03743e0eacf7a0c01c279776fef4e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm: fix dm_blk_report_zones\\n\\nIf dm_get_live_table() returned NULL, dm_put_live_table() was never\\ncalled. Also, it is possible that md-\u003ezone_revalidate_map will change\\nwhile calling this function. Only read it once, so that we are always\\nusing the same value. Otherwise we might miss a call to\\ndm_put_live_table().\\n\\nFinally, while md-\u003ezone_revalidate_map is set and a process is calling\\nblk_revalidate_disk_zones() to set up the zone append emulation\\nresources, it is possible that another process, perhaps triggered by\\nblkdev_report_zones_ioctl(), will call dm_blk_report_zones(). If\\nblk_revalidate_disk_zones() fails, these resources can be freed while\\nthe other process is still using them, causing a use-after-free error.\\n\\nblk_revalidate_disk_zones() will only ever be called when initially\\nsetting up the zone append emulation resources, such as when setting up\\na zoned dm-crypt table for the first time. Further table swaps will not\\nset md-\u003ezone_revalidate_map or call blk_revalidate_disk_zones().\\nHowever it must be called using the new table (referenced by\\nmd-\u003ezone_revalidate_map) and the new queue limits while the DM device is\\nsuspended. dm_blk_report_zones() needs some way to distinguish between a\\ncall from blk_revalidate_disk_zones(), which must be allowed to use\\nmd-\u003ezone_revalidate_map to access this not yet activated table, and all\\nother calls to dm_blk_report_zones(), which should not be allowed while\\nthe device is suspended and cannot use md-\u003ezone_revalidate_map, since\\nthe zone resources might be freed by the process currently calling\\nblk_revalidate_disk_zones().\\n\\nSolve this by tracking the process that sets md-\u003ezone_revalidate_map in\\ndm_revalidate_zones() and only allowing that process to make use of it\\nin dm_blk_report_zones().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.34\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.15.3\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16\", \"versionStartIncluding\": \"6.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-07-30T05:51:40.314Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-38141\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-30T05:51:40.314Z\", \"dateReserved\": \"2025-04-16T04:51:23.987Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-07-03T08:35:42.787Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.