CVE-2025-38496
BaseFortify
Publication date: 2025-07-28
Last updated on: 2025-11-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is in the Linux kernel's dm-bufio component. It occurs when dm-verity is configured with "try_verify_in_tasklet" and DM_BUFIO_CLIENT_NO_SLEEP is enabled. During buffer eviction, the code may trigger scheduling in an atomic context (specifically in spin_lock_bh), which is invalid and causes a kernel warning or bug due to a sleeping function being called from an invalid context. This can lead to kernel instability or crashes.
How can this vulnerability impact me? :
The vulnerability can cause kernel warnings and potentially kernel crashes or instability due to improper scheduling in atomic context. This can affect system reliability and availability, especially on systems using dm-verity with the affected configuration.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel warning messages related to scheduling in atomic context in the dm-bufio module. Specifically, look for BUG messages like "sleeping function called from invalid context" in kernel logs. You can check the kernel log using the command: dmesg | grep dm_bufio. Additionally, reproducing the issue involves using veritysetup and dmsetup commands as follows: veritysetup format --data-block-size=4096 --hash-block-size=4096 /dev/vda /dev/vdb SIZE=$(blockdev --getsz /dev/vda) dmsetup create myverity -r --table "0 $SIZE verity 1 /dev/vda /dev/vdb 4096 4096 <data_blocks> 1 sha256 <root_hash> <salt> 1 try_verify_in_tasklet" mount /dev/dm-0 /mnt -o ro echo 102400 > /sys/module/dm_bufio/parameters/max_cache_size_bytes [read files in /mnt]