In the Linux kernel, the following vulnerability has been resolved:
blk-mq: check kobject stateinsysfs before deleting in blkmqunregister_hctx
In _blkmqupdatenrhwqueues() the return value of blkmqsysfsregisterhctxs() is not checked. If sysfs creation for hctx fails, later changing the number of hw_queues or removing disk will trigger the following warning:
kernfs: can not remove 'nrtags', no directory WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfsremovebynamens+0x13f/0x160 Call Trace: removefiles.isra.1+0x38/0xb0 sysfsremovegroup+0x4d/0x100 sysfsremovegroups+0x31/0x60 _kobjectdel+0x23/0xf0 kobjectdel+0x17/0x40 blkmqunregisterhctx+0x5d/0x80 blkmqsysfsunregisterhctxs+0x94/0xd0 blkmqupdatenrhwqueues+0x124/0x760 nullbupdatenrhwqueues+0x71/0xf0 [nullblk] nullbdevicesubmitqueuesstore+0x92/0x120 [null_blk]
kobjct_del() was called unconditionally even if sysfs creation failed. Fix it by checkig the kobject creation statusbefore deleting it.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40125.json"
}