CVE-2025-38255
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38255
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38255.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38255
- Downstream
- Related
- Published
- 2025-07-09T10:42:33Z
- Modified
- 2025-10-18T04:11:15.035259Z
- Summary
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
lib/groupcpus: fix NULL pointer dereference from groupcpus_evenly()
While testing nullblk with configfs, echo 0 > pollqueues will trigger following panic:
BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 27 UID: 0 PID: 920 Comm: bash Not tainted 6.15.0-02023-gadbdb95c8696-dirty #1238 PREEMPT(undef) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:_bitmapor+0x48/0x70 Call Trace: <TASK> _groupcpusevenly+0x822/0x8c0 groupcpusevenly+0x2d9/0x490 blkmqmapqueues+0x1e/0x110 nullmapqueues+0xc9/0x170 [nullblk] blkmqupdatequeuemap+0xdb/0x160 blkmqupdatenrhwqueues+0x22b/0x560 nullbupdatenrhwqueues+0x71/0xf0 [nullblk] nullbdevicepollqueuesstore+0xa4/0x130 [nullblk] configfswriteiter+0x109/0x1d0 vfswrite+0x26e/0x6f0 ksyswrite+0x79/0x180 _x64syswrite+0x1d/0x30 x64syscall+0x45c4/0x45f0 dosyscall64+0xa5/0x240 entrySYSCALL64after_hwframe+0x76/0x7e
Root cause is that numgrps is set to 0, and ZEROSIZEPTR is returned from kcalloc(), and later ZEROSIZEPTR will be deferenced.
Fix the problem by checking numgrps first in groupcpusevenly(), and return NULL directly if numgrps is zero.
[yukuai3@huawei.com: also fix the non-SMP version]
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/29d39e0d5f16c060e32542b2cf351c09fd22b250
- https://git.kernel.org/stable/c/64a99eff8dcf1f951a544e6058341b2b19a8fdbd
- https://git.kernel.org/stable/c/911ef2e8a7de5b2bae8ff11fb0bd01f699e6db65
- https://git.kernel.org/stable/c/df831e97739405ecbaddb85516bc7d4d1c933d6b
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6a6dcae8f486c3f3298d0767d34505121c7b0b81Fixed64a99eff8dcf1f951a544e6058341b2b19a8fdbd
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6a6dcae8f486c3f3298d0767d34505121c7b0b81Fixed29d39e0d5f16c060e32542b2cf351c09fd22b250
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6a6dcae8f486c3f3298d0767d34505121c7b0b81Fixed911ef2e8a7de5b2bae8ff11fb0bd01f699e6db65
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6a6dcae8f486c3f3298d0767d34505121c7b0b81Fixeddf831e97739405ecbaddb85516bc7d4d1c933d6b