Linux Kernel Vulnerability CVE-2025-38140: Zone Write Plug Resource Mismanagement
Summary
CVE-2025-38140: In the Linux kernel, the following vulnerability has been resolved: dm: limit swapping tables for devices with zone write plugs dm_revalidate_zones() only allowed new or previously unzoned devices to call blk_revalidate_... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process scheduling, and system security. It supports a wide range of devices and file systems, making it a critical element in both server and desktop environments. This vulnerability specifically affects the device mapper (dm) functionality, which is responsible for managing logical volumes and storage devices. The issue arises from improper handling of zoned devices with zone write plug resources, potentially leading to data inconsistencies and system errors.
Vulnerability Detail
In the Linux kernel, the vulnerability CVE-2025-38140 originates from the dm_revalidate_zones() function, which fails to properly validate zoned devices that already have zone write plug resources. When a device is zoned, the function does not update the zoned settings correctly, leading to mismatches between the device's actual configuration and the expected configuration. This can result in errors such as reading invalid memory, which may compromise system stability and data integrity. The vulnerability affects devices that have zone write plug resources allocated, as they cannot switch to a different zoned table without risking further issues.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid changing the zoned settings for devices that already have zone write plug resources allocated. This means not switching to a different zoned table or altering the device size or zone size until a patch is applied.
Conclusion
CVE-2025-38140 is a significant vulnerability in the Linux kernel that affects the management of zoned devices. It is crucial for users to update their systems to the latest patched version to avoid potential data corruption and system instability. Temporary workarounds are available, but applying the patch is the best course of action.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38140 is a vulnerability in the Linux kernel that affects the management of zoned devices with zone write plug resources, potentially leading to data inconsistencies.
If your system uses zoned devices with zone write plug resources, this vulnerability could lead to errors and data corruption, impacting system stability.
Yes, a patch is available in the latest versions of the Linux kernel. Users should update their kernel to the patched version to mitigate the risk.
As a temporary measure, avoid changing the zoned settings for affected devices until you can apply the patch.
You can use Vulert, a tool that monitors open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities without needing to install any software.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
