« Volver al listado

CVE-2025-40125

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx

In __blk_mq_update_nr_hw_queues() the return value of blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx fails, later changing the number of hw_queues or removing disk will trigger the following warning:

kobjct_del() was called unconditionally even if sysfs creation failed. Fix it by checkig the kobject creation statusbefore deleting it.

Detalles técnicos trazas, registros y código del informe original
  kernfs: can not remove 'nr_tags', no directory
  WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
  Call Trace:
   remove_files.isra.1+0x38/0xb0
   sysfs_remove_group+0x4d/0x100
   sysfs_remove_groups+0x31/0x60
   __kobject_del+0x23/0xf0
   kobject_del+0x17/0x40
   blk_mq_unregister_hctx+0x5d/0x80
   blk_mq_sysfs_unregister_hctxs+0x94/0xd0
   blk_mq_update_nr_hw_queues+0x124/0x760
   nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
   nullb_device_submit_queues_store+0x92/0x120 [null_blk]

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-40125",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "477e19dedc9d3e1f4443a1d4ae00572a988120ea",
              "lessThan": "a8c53553f1833cc2d14175d2d72cf37193a01898",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "477e19dedc9d3e1f4443a1d4ae00572a988120ea",
              "lessThan": "cc14ea21c4e658814d737ed4dedde6cd626a15ad",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "477e19dedc9d3e1f4443a1d4ae00572a988120ea",
              "lessThan": "4b97e99b87a773d52699521d40864f3ec888e9a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "477e19dedc9d3e1f4443a1d4ae00572a988120ea",
              "lessThan": "6e7dadc5763c48eb3b9b91265a21f312599ebb2c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "477e19dedc9d3e1f4443a1d4ae00572a988120ea",
              "lessThan": "06c4826b1d900611096e4621e93133db57e13911",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "477e19dedc9d3e1f4443a1d4ae00572a988120ea",
              "lessThan": "babc634e9fe2803962dba98a07587e835dbc0731",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "477e19dedc9d3e1f4443a1d4ae00572a988120ea",
              "lessThan": "d5ddd76ee52bdc16e9f8b1e7791291e785dab032",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "477e19dedc9d3e1f4443a1d4ae00572a988120ea",
              "lessThan": "4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "block/blk-mq-sysfs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.20",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "block/blk-mq-sysfs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-11-12T11:15:42.043",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/06c4826b1d900611096e4621e93133db57e13911",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4b97e99b87a773d52699521d40864f3ec888e9a6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6e7dadc5763c48eb3b9b91265a21f312599ebb2c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a8c53553f1833cc2d14175d2d72cf37193a01898",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/babc634e9fe2803962dba98a07587e835dbc0731",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cc14ea21c4e658814d737ed4dedde6cd626a15ad",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d5ddd76ee52bdc16e9f8b1e7791291e785dab032",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx\n\nIn __blk_mq_update_nr_hw_queues() the return value of\nblk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx\nfails, later changing the number of hw_queues or removing disk will\ntrigger the following warning:\n\n  kernfs: can not remove 'nr_tags', no directory\n  WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160\n  Call Trace:\n   remove_files.isra.1+0x38/0xb0\n   sysfs_remove_group+0x4d/0x100\n   sysfs_remove_groups+0x31/0x60\n   __kobject_del+0x23/0xf0\n   kobject_del+0x17/0x40\n   blk_mq_unregister_hctx+0x5d/0x80\n   blk_mq_sysfs_unregister_hctxs+0x94/0xd0\n   blk_mq_update_nr_hw_queues+0x124/0x760\n   nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]\n   nullb_device_submit_queues_store+0x92/0x120 [null_blk]\n\nkobjct_del() was called unconditionally even if sysfs creation failed.\nFix it by checkig the kobject creation statusbefore deleting it."
    }
  ],
  "lastModified": "2026-06-17T09:21:18.427",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}