CVE-2025-38140: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38140 is a local denial-of-service vulnerability in the Linux kernel's device mapper (dm) subsystem, specifically in the handling of zone write plug resources during device table reloads. The flaw exists in dm_revalidate_zones(), which failed to properly update zoned settings when a device table was swapped on an already-zoned device, potentially causing bdev_zone_is_seq() to read invalid memory due to an incorrectly sized conv_zones_bitmap. It affects Linux kernel versions from 5.14 up to (but not including) 6.15.3. The vulnerability was disclosed on July 3, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper resource management (CWE-119/CWE-416 class) in dm_revalidate_zones(): when a device was already zoned, disk->nr_zones equaled md->nr_zones, causing the function to return early without calling blk_revalidate_disk_zones(), leaving zoned settings out of sync with the new table. If blk_revalidate_disk_zones() fails, it can overwrite or clear disk->nr_zones, requiring DM to restore the previous value to maintain consistency. The fix disallows table reloads that change zoned settings for devices that already have zone write plug resources allocated — such devices may only switch to another zoned table that also emulates zone append, and cannot change device or zone size. Exploitation requires local access with low privileges to manipulate device mapper table configurations on systems using zoned storage devices (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).

Successful exploitation can cause system instability or crashes on Linux systems using zoned storage devices (e.g., SMR hard drives or NVMe ZNS devices), constituting a local denial of service. The vulnerability has no confidentiality or integrity impact; the availability impact is rated High. Affected systems include those running Linux kernel 5.14 through 6.15.2 with device mapper and zoned block device configurations (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and a system specifically configured with zoned storage devices and device mapper (Red Hat Advisory).

The primary remediation is to update the Linux kernel to version 6.15.3 or later, which contains the upstream fix. Patches have also been backported and are available via upstream stable commits. Downstream distributions including Ubuntu (USN-7770-1, USN-7771-1, USN-7789-1), SUSE, and openSUSE have released updated kernel packages. As a workaround, restrict local user access to device mapper configurations and avoid performing table reloads that change zoned settings on devices with existing zone write plug resources (Red Hat Advisory, Ubuntu USN-7770-1, Kernel Patch 1).