CVE-2025-38072
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-12-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | to 5.4.294 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.238 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.185 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.141 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.93 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.31 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.14.9 (exc) |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-908 | The product uses or accesses a resource that has not been initialized. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's libnvdimm driver when a faulty CXL memory device returns a zero LSA size in its memory device information. This causes a divide-by-zero error during initialization in the nd_label_data_init() function, leading to a kernel crash (divide error). The issue arises because the driver does not properly check for a zero LSA size before performing division operations.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to a divide-by-zero error when interacting with certain faulty CXL memory devices. This can lead to system instability, potential denial of service, and unexpected reboots, impacting system availability and reliability.
What immediate steps should I take to mitigate this vulnerability?
Update the Linux kernel to a version that includes the fix for the divide error in the libnvdimm driver (nd_label_data_init). The fix involves checking the config size parameter to prevent division by zero when a faulty CXL memory device returns a zero LSA size. Until the update is applied, avoid using faulty CXL memory devices that may trigger this issue.