In the Linux kernel, the following vulnerability has been resolved:
dm cache: prevent BUG_ON by blocking retries on failed device resumes
A cache device failing to resume due to mapping errors should not be retried, as the failure leaves a partially initialized policy object. Repeating the resume operation risks triggering BUG_ON when reloading cache mappings into the incomplete policy object.
Reproduce steps:
cat <<EOF >> cmeta.xml <superblock uuid="" block_size="128" nr_cache_blocks="512" \ policy="smq" hint_width="4"> <mappings> <mapping cache_block="0" origin_block="0" dirty="false"/> </mappings> </superblock> EOF dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" cache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2 dmsetup remove cmeta
mappingroot=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2>/dev/null | hexdump -e '1/8 "%u\n"') ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mappingroot+2056)) \ 2>/dev/null | hexdump -e '1/8 "%u\n"') dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dmsetup create cache --notable dmsetup load cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" dmsetup resume cache
dmsetup resume cache
Kernel logs:
(snip) ------------[ cut here ]------------ kernel BUG at drivers/md/dm-cache-policy-smq.c:752! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 UID: 0 PID: 332 Comm: dmsetup Not tainted 6.13.4 #3 RIP: 0010:smqloadmapping+0x3e5/0x570
Fix by disallowing resume operations for devices that failed the initial attempt.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38066.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38066.json"
[
{
"signature_version": "v1",
"target": {
"file": "drivers/md/dm-cache-target.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00586b78eeb7c626a14ca13453a1631f88a7cf36",
"deprecated": false,
"digest": {
"line_hashes": [
"113793373369616219526425872961315620725",
"238568026495569720368573001887965700330",
"274467550883803234503144346420099286561",
"81841094565090464322203456098726019980",
"181109070145630504674448396538460347983",
"263941346241015978300796661244204567712"
],
"threshold": 0.9
},
"id": "CVE-2025-38066-bef168c8",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/md/dm-cache-target.c",
"function": "cache_preresume"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00586b78eeb7c626a14ca13453a1631f88a7cf36",
"deprecated": false,
"digest": {
"function_hash": "283702822477146923733503155940833242870",
"length": 1015.0
},
"id": "CVE-2025-38066-d5832fb1",
"signature_type": "Function"
}
]