linux-cve-announce - CVE-2025-40134: dm: fix NULL pointer dereference in __dm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025111254-CVE-2025-40134-4d24@gregkh>
Date: Wed, 12 Nov 2025 19:24:10 +0900
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

dm: fix NULL pointer dereference in __dm_suspend()

There is a race condition between dm device suspend and table load that
can lead to null pointer dereference. The issue occurs when suspend is
invoked before table load completes:

BUG: kernel NULL pointer dereference, address: 0000000000000054
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50
Call Trace:
  <TASK>
  blk_mq_quiesce_queue+0x2c/0x50
  dm_stop_queue+0xd/0x20
  __dm_suspend+0x130/0x330
  dm_suspend+0x11a/0x180
  dev_suspend+0x27e/0x560
  ctl_ioctl+0x4cf/0x850
  dm_ctl_ioctl+0xd/0x20
  vfs_ioctl+0x1d/0x50
  __se_sys_ioctl+0x9b/0xc0
  __x64_sys_ioctl+0x19/0x30
  x64_sys_call+0x2c4a/0x4620
  do_syscall_64+0x9e/0x1b0

The issue can be triggered as below:

T1 						T2
dm_suspend					table_load
__dm_suspend					dm_setup_md_queue
						dm_mq_init_request_queue
						blk_mq_init_allocated_queue
						=> q->mq_ops = set->ops; (1)
dm_stop_queue / dm_wait_for_completion
=> q->tag_set NULL pointer!	(2)
						=> q->tag_set = set; (3)

Fix this by checking if a valid table (map) exists before performing
request-based suspend and waiting for target I/O. When map is NULL,
skip these table-dependent suspend steps.

Even when map is NULL, no I/O can reach any target because there is
no table loaded; I/O submitted in this state will fail early in the
DM layer. Skipping the table-dependent suspend logic in this case
is safe and avoids NULL pointer dereferences.

The Linux kernel CVE team has assigned CVE-2025-40134 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.0 with commit c4576aed8d85d808cd6443bda58393d525207d01 and fixed in 5.4.301 with commit 9dc43ea6a20ff83fe9a5fe4be47ae0fbf2409b98
	Issue introduced in 5.0 with commit c4576aed8d85d808cd6443bda58393d525207d01 and fixed in 5.10.246 with commit 30f95b7eda5966b81cb221bd569c0f095a068cf6
	Issue introduced in 5.0 with commit c4576aed8d85d808cd6443bda58393d525207d01 and fixed in 5.15.195 with commit a0e54bd8d7ea79127fe9920df3ae36f85e79ac7c
	Issue introduced in 5.0 with commit c4576aed8d85d808cd6443bda58393d525207d01 and fixed in 6.1.156 with commit a802901b75e13cc306f1b7ab0f062135c8034e9e
	Issue introduced in 5.0 with commit c4576aed8d85d808cd6443bda58393d525207d01 and fixed in 6.6.112 with commit 846cafc4725ca727d94f9c4b5f789c1a7c8fb6fe
	Issue introduced in 5.0 with commit c4576aed8d85d808cd6443bda58393d525207d01 and fixed in 6.12.53 with commit 19ca4528666990be376ac3eb6fe667b03db5324d
	Issue introduced in 5.0 with commit c4576aed8d85d808cd6443bda58393d525207d01 and fixed in 6.17.3 with commit 331c2dd8ca8bad1a3ac10cce847ffb76158eece4
	Issue introduced in 5.0 with commit c4576aed8d85d808cd6443bda58393d525207d01 and fixed in 6.18-rc1 with commit 8d33a030c566e1f105cd5bf27f37940b6367f3be

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-40134
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/md/dm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9dc43ea6a20ff83fe9a5fe4be47ae0fbf2409b98
	https://git.kernel.org/stable/c/30f95b7eda5966b81cb221bd569c0f095a068cf6
	https://git.kernel.org/stable/c/a0e54bd8d7ea79127fe9920df3ae36f85e79ac7c
	https://git.kernel.org/stable/c/a802901b75e13cc306f1b7ab0f062135c8034e9e
	https://git.kernel.org/stable/c/846cafc4725ca727d94f9c4b5f789c1a7c8fb6fe
	https://git.kernel.org/stable/c/19ca4528666990be376ac3eb6fe667b03db5324d
	https://git.kernel.org/stable/c/331c2dd8ca8bad1a3ac10cce847ffb76158eece4
	https://git.kernel.org/stable/c/8d33a030c566e1f105cd5bf27f37940b6367f3be