CVE-2025-38442

block: reject bs > ps block devices when THP is disabled

published July 25, 2025

CVSS
—
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

block: reject bs > ps block devices when THP is disabled

If THP is disabled and when a block device with logical block size >

page size is present, the following null ptr deref panic happens during

boot:

[ [13.2 mK AOSAN: null-ptr-deref in range [0x0000000000000000-0x0000000000K0 0 0[07]

[ 13.017749] RIP: 0010:create_empty_buffers+0x3b/0x380

<snip>

[ 13.025448] Call Trace:

[ 13.025692] <TASK>

[ 13.025895] block_read_full_folio+0x610/0x780

[ 13.026379] ? __pfx_blkdev_get_block+0x10/0x10

[ 13.027008] ? __folio_batch_add_and_move+0x1fa/0x2b0

[ 13.027548] ? __pfx_blkdev_read_folio+0x10/0x10

[ 13.028080] filemap_read_folio+0x9b/0x200

[ 13.028526] ? __pfx_filemap_read_folio+0x10/0x10

[ 13.029030] ? __filemap_get_folio+0x43/0x620

[ 13.029497] do_read_cache_folio+0x155/0x3b0

[ 13.029962] ? __pfx_blkdev_read_folio+0x10/0x10

[ 13.030381] read_part_sector+0xb7/0x2a0

[ 13.030805] read_lba+0x174/0x2c0

<snip>

[ 13.045348] nvme_scan_ns+0x684/0x850 [nvme_core]

[ 13.045858] ? __pfx_nvme_scan_ns+0x10/0x10 [nvme_core]

[ 13.046414] ? _raw_spin_unlock+0x15/0x40

[ 13.046843] ? __switch_to+0x523/0x10a0

[ 13.047253] ? kvm_clock_get_cycles+0x14/0x30

[ 13.047742] ? __pfx_nvme_scan_ns_async+0x10/0x10 [nvme_core]

[ 13.048353] async_run_entry_fn+0x96/0x4f0

[ 13.048787] process_one_work+0x667/0x10a0

[ 13.049219] worker_thread+0x63c/0xf60

As large folio support depends on THP, only allow bs > ps block devices

if THP is enabled.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00148 · 3.7th percentile
Published
2025-07-25T15:27Z
EPSS history
Timeline
  • 25 JUL 15:27Z
    block: reject bs > ps block devices when THP is disabled
    cvelistv5