In the Linux kernel, the following vulnerability has been resolved:
libnvdimm/labels: Fix divide error in ndlabeldata_init()
If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver:
Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:ndlabeldata_init+0x10e/0x800 [libnvdimm]
Code and flow:
1) CXL Command 4000h returns LSA size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver):
drivers/cxl/pmem.c: .configsize = mds->lsasize,
3) max_xfer is set to zero (nvdimm driver):
drivers/nvdimm/label.c: maxxfer = mint(sizet, ndd->nsarea.maxxfer, config_size);
4) A subsequent DIVROUNDUP() causes a division by zero:
drivers/nvdimm/label.c: /* Make our initial read size a multiple of maxxfer size */ drivers/nvdimm/label.c: readsize = min(DIVROUNDUP(readsize, maxxfer) * maxxfer, drivers/nvdimm/label.c- configsize);
Fix this by checking the config size parameter by extending an existing check.
[
{
"digest": {
"length": 1759.0,
"function_hash": "141971492284864967550945850316487855945"
},
"target": {
"file": "drivers/nvdimm/label.c",
"function": "nd_label_data_init"
},
"deprecated": false,
"id": "CVE-2025-38072-15322fb8",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bd4a938d2eda96ab7288b8fa5aae84a1de8c4ca",
"signature_type": "Function"
},
{
"digest": {
"length": 1759.0,
"function_hash": "141971492284864967550945850316487855945"
},
"target": {
"file": "drivers/nvdimm/label.c",
"function": "nd_label_data_init"
},
"deprecated": false,
"id": "CVE-2025-38072-29d6bd91",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea3d95e05e97ea20fd6513f647393add16fce3b2",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"335084466941255917811571515333731102512",
"86603354856225400135087685814970000011",
"241664569623205313123531012624676629087",
"145191643672830405120886739650744061538"
],
"threshold": 0.9
},
"target": {
"file": "drivers/nvdimm/label.c"
},
"deprecated": false,
"id": "CVE-2025-38072-41025d88",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea3d95e05e97ea20fd6513f647393add16fce3b2",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"335084466941255917811571515333731102512",
"86603354856225400135087685814970000011",
"241664569623205313123531012624676629087",
"145191643672830405120886739650744061538"
],
"threshold": 0.9
},
"target": {
"file": "drivers/nvdimm/label.c"
},
"deprecated": false,
"id": "CVE-2025-38072-522e262e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bd4a938d2eda96ab7288b8fa5aae84a1de8c4ca",
"signature_type": "Line"
}
]