In the Linux kernel, the following vulnerability has been resolved:
dm: fix unconditional IO throttle caused by REQ_PREFLUSH
When a bio with REQPREFLUSH is submitted to dm, _sendemptyflush() generates a flushbio with REQOPWRITE | REQPREFLUSH | REQSYNC, which causes the flushbio to be throttled by wbt_wait().
An example from v5.4, similar problem also exists in upstream:
crash> bt 2091206
PID: 2091206  TASK: ffff2050df92a300  CPU: 109  COMMAND: "kworker/u260:0"
 #0 [ffff800084a2f7f0] __switch_to at ffff80004008aeb8
 #1 [ffff800084a2f820] __schedule at ffff800040bfa0c4
 #2 [ffff800084a2f880] schedule at ffff800040bfa4b4
 #3 [ffff800084a2f8a0] io_schedule at ffff800040bfa9c4
 #4 [ffff800084a2f8c0] rq_qos_wait at ffff8000405925bc
 #5 [ffff800084a2f940] wbt_wait at ffff8000405bb3a0
 #6 [ffff800084a2f9a0] __rq_qos_throttle at ffff800040592254
 #7 [ffff800084a2f9c0] blk_mq_make_request at ffff80004057cf38
 #8 [ffff800084a2fa60] generic_make_request at ffff800040570138
 #9 [ffff800084a2fae0] submit_bio at ffff8000405703b4
#10 [ffff800084a2fb50] xlog_write_iclog at ffff800001280834 [xfs]
#11 [ffff800084a2fbb0] xlog_sync at ffff800001280c3c [xfs]
#12 [ffff800084a2fbf0] xlog_state_release_iclog at ffff800001280df4 [xfs]
#13 [ffff800084a2fc10] xlog_write at ffff80000128203c [xfs]
#14 [ffff800084a2fcd0] xlog_cil_push at ffff8000012846dc [xfs]
#15 [ffff800084a2fda0] xlog_cil_push_work at ffff800001284a2c [xfs]
#16 [ffff800084a2fdb0] process_one_work at ffff800040111d08
#17 [ffff800084a2fe00] worker_thread at ffff8000401121cc
#18 [ffff800084a2fe70] kthread at ffff800040118de4
After commit 2def2845cc33 ("xfs: don't allow log IO to be throttled"), the metadata submitted by xlogwriteiclog() should not be throttled. But due to the existence of the dm layer, throttling flush_bio indirectly causes the metadata bio to be throttled.
Fix this by conditionally adding REQIDLE to flushbio.biopf, which makes wbtshouldthrottle() return false to avoid wbtwait().
[
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2858cda9a8d95e6deee7e3b0a26adde696a9a4f5",
        "digest": {
            "function_hash": "33292712220433327300753825768645765681",
            "length": 1141.0
        },
        "target": {
            "function": "__send_empty_flush",
            "file": "drivers/md/dm.c"
        },
        "id": "CVE-2025-38063-0087caf3",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88f7f56d16f568f19e1a695af34a7f4a6ce537a6",
        "digest": {
            "line_hashes": [
                "320777613191697552600529476382873842542",
                "124581509308412811362112874075884401272",
                "225184438066402703291700037820541057060",
                "258190885940097842335610555584174844072",
                "245044035471729365015348234835742902517",
                "50568756736325421147399684005381322281"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "drivers/md/dm.c"
        },
        "id": "CVE-2025-38063-2ca540ca",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88f7f56d16f568f19e1a695af34a7f4a6ce537a6",
        "digest": {
            "function_hash": "33292712220433327300753825768645765681",
            "length": 1141.0
        },
        "target": {
            "function": "__send_empty_flush",
            "file": "drivers/md/dm.c"
        },
        "id": "CVE-2025-38063-4180ca5e",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52aa28f7b1708d76e315d78b5ed397932a1a97c3",
        "digest": {
            "line_hashes": [
                "320777613191697552600529476382873842542",
                "124581509308412811362112874075884401272",
                "225184438066402703291700037820541057060",
                "258190885940097842335610555584174844072",
                "245044035471729365015348234835742902517",
                "50568756736325421147399684005381322281"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "drivers/md/dm.c"
        },
        "id": "CVE-2025-38063-50cb1de3",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52aa28f7b1708d76e315d78b5ed397932a1a97c3",
        "digest": {
            "function_hash": "57806084720353987685216332141210050780",
            "length": 702.0
        },
        "target": {
            "function": "__send_empty_flush",
            "file": "drivers/md/dm.c"
        },
        "id": "CVE-2025-38063-9d95310c",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2858cda9a8d95e6deee7e3b0a26adde696a9a4f5",
        "digest": {
            "line_hashes": [
                "320777613191697552600529476382873842542",
                "124581509308412811362112874075884401272",
                "225184438066402703291700037820541057060",
                "258190885940097842335610555584174844072",
                "245044035471729365015348234835742902517",
                "50568756736325421147399684005381322281"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "drivers/md/dm.c"
        },
        "id": "CVE-2025-38063-e6c27d75",
        "deprecated": false,
        "signature_type": "Line"
    }
]