Divide Error Vulnerability in Linux Kernel's libnvdimm Driver
Summary
CVE-2025-38072: In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide error in nd_label_data_init() If a faulty CXL memory device returns a broken zero LSA size in its memory device information... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core of many operating systems, providing essential services for hardware and software interactions. The libnvdimm driver is responsible for managing non-volatile memory devices, enabling efficient data storage and retrieval. This vulnerability arises from the handling of faulty CXL memory devices, which can lead to critical errors in memory management.
Vulnerability Detail
In the Linux kernel, a divide error occurs in the libnvdimm driver when a faulty CXL memory device reports a zero Logical Sector Address (LSA) size. This situation leads to a division by zero in the code, specifically during the calculation of read sizes. The vulnerability can cause system crashes or unexpected behavior, impacting the stability and reliability of systems utilizing affected memory devices.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that faulty CXL memory devices are not used in your system until the patch is applied. Additionally, you can implement checks in your code to validate the LSA size before proceeding with operations that depend on it.
Conclusion
The CVE-2025-38072 vulnerability in the Linux kernel's libnvdimm driver poses a significant risk due to potential system crashes from divide errors. It is crucial to apply the available patches and implement workarounds to mitigate risks while monitoring for vulnerabilities using tools like Vulert.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38072 is a vulnerability in the Linux kernel's libnvdimm driver that can lead to a divide error when handling faulty CXL memory devices.
This vulnerability can cause system crashes or unexpected behavior, particularly in systems that utilize affected CXL memory devices.
Yes, a patch is available for Debian 13 in version 6.12.32-1. Users of Debian 11 and 12 should check for updates.
As a temporary measure, avoid using faulty CXL memory devices and implement checks in your code to validate LSA sizes.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can also check for vulnerabilities in your application using the Vulert playground without signing up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
