dm: limit swapping tables for devices with zone write plugs
In the Linux kernel, the following vulnerability has been resolved: dm: limit swapping tables for devices with zone write plugs dm_revalidate_zones() only allowed new or previously unzoned devices to call blk_revalidate_disk_zones(). If the device was already zoned, disk->nr_zones would always equal md->nr_zones, so dm_revalidate_zones() returned without doing any work. This would make the zoned settings for the device not match the new table. If the device had zone write plug resources, it could run into errors like bdev_zone_is_seq() reading invalid memory because disk->conv_zones_bitmap was the wrong size. If the device doesn't have any zone write plug resources, calling blk_revalidate_disk_zones() will always correctly update device. If blk_revalidate_disk_zones() fails, it can still overwrite or clear the current disk->nr_zones value. In this case, DM must restore the previous value of disk->nr_zones, so that the zoned settings will continue to match the previous value that it fell back to. If the device already has zone write plug resources, blk_revalidate_disk_zones() will not correctly update them, if it is called for arbitrary zoned device changes. Since there is not much need for this ability, the easiest solution is to disallow any table reloads that change the zoned settings, for devices that already have zone plug resources. Specifically, if a device already has zone plug resources allocated, it can only switch to another zoned table that also emulates zone appen
CVE-2025-38140
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-38140
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "bb37d77239af25cde59693dbe3fac04dd17d7b29",
"lessThan": "13c0425c99c67c2296f1eec61254a4f91484eac3",
"versionType": "git"
},
{
"status": "affected",
"version": "bb37d77239af25cde59693dbe3fac04dd17d7b29",
"lessThan": "ac8acb0bfd98a1c65f3ca9a3e217a766124eebd8",
"versionType": "git"
},
{
"status": "affected",
"version": "bb37d77239af25cde59693dbe3fac04dd17d7b29",
"lessThan": "121218bef4c1df165181f5cd8fc3a2246bac817e",
"versionType": "git"
}
],
"programFiles": [
"drivers/md/dm-table.c",
"drivers/md/dm-zone.c",
"drivers/md/dm.c",
"drivers/md/dm.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver",
"lessThanOrEqual": "6.15.*"
},
{
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/md/dm-table.c",
"drivers/md/dm-zone.c",
"drivers/md/dm.c",
"drivers/md/dm.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-38140
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #45988 · Revision 1
- Added to Heist Feed
- Publisher date