In the Linux kernel, the following vulnerability has been resolved:
libnvdimm/labels: Fix divide error in ndlabeldata_init()
If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver:
Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:ndlabeldata_init+0x10e/0x800 [libnvdimm]
Code and flow:
1) CXL Command 4000h returns LSA size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver):
drivers/cxl/pmem.c: .configsize = mds->lsasize,
3) max_xfer is set to zero (nvdimm driver):
drivers/nvdimm/label.c: maxxfer = mint(sizet, ndd->nsarea.maxxfer, config_size);
4) A subsequent DIVROUNDUP() causes a division by zero:
drivers/nvdimm/label.c: /* Make our initial read size a multiple of maxxfer size */ drivers/nvdimm/label.c: readsize = min(DIVROUNDUP(readsize, maxxfer) * maxxfer, drivers/nvdimm/label.c- configsize);
Fix this by checking the config size parameter by extending an existing check.
[
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38072-15a7d598",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f49c337037df029440a8390380dd35d2cf5924d3",
"digest": {
"line_hashes": [
"335084466941255917811571515333731102512",
"86603354856225400135087685814970000011",
"241664569623205313123531012624676629087",
"145191643672830405120886739650744061538"
],
"threshold": 0.9
},
"signature_type": "Line",
"target": {
"file": "drivers/nvdimm/label.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38072-45a02f0a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d1e1efad1cf049e888bf175a5c6be85d792620c",
"digest": {
"line_hashes": [
"335084466941255917811571515333731102512",
"86603354856225400135087685814970000011",
"241664569623205313123531012624676629087",
"145191643672830405120886739650744061538"
],
"threshold": 0.9
},
"signature_type": "Line",
"target": {
"file": "drivers/nvdimm/label.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38072-bab410cf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d1e1efad1cf049e888bf175a5c6be85d792620c",
"digest": {
"function_hash": "141971492284864967550945850316487855945",
"length": 1759.0
},
"signature_type": "Function",
"target": {
"function": "nd_label_data_init",
"file": "drivers/nvdimm/label.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38072-c051e1f9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db1aef51b8e66a77f76b1250b914589c31a0a0ed",
"digest": {
"line_hashes": [
"335084466941255917811571515333731102512",
"86603354856225400135087685814970000011",
"241664569623205313123531012624676629087",
"145191643672830405120886739650744061538"
],
"threshold": 0.9
},
"signature_type": "Line",
"target": {
"file": "drivers/nvdimm/label.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38072-ca1d6f2b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@396c46d3f59a18ebcc500640e749f16e197d472b",
"digest": {
"function_hash": "141971492284864967550945850316487855945",
"length": 1759.0
},
"signature_type": "Function",
"target": {
"function": "nd_label_data_init",
"file": "drivers/nvdimm/label.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38072-d9dc7ed6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db1aef51b8e66a77f76b1250b914589c31a0a0ed",
"digest": {
"function_hash": "141971492284864967550945850316487855945",
"length": 1759.0
},
"signature_type": "Function",
"target": {
"function": "nd_label_data_init",
"file": "drivers/nvdimm/label.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38072-f7fd06c7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f49c337037df029440a8390380dd35d2cf5924d3",
"digest": {
"function_hash": "141971492284864967550945850316487855945",
"length": 1759.0
},
"signature_type": "Function",
"target": {
"function": "nd_label_data_init",
"file": "drivers/nvdimm/label.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38072-fe9cec84",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@396c46d3f59a18ebcc500640e749f16e197d472b",
"digest": {
"line_hashes": [
"335084466941255917811571515333731102512",
"86603354856225400135087685814970000011",
"241664569623205313123531012624676629087",
"145191643672830405120886739650744061538"
],
"threshold": 0.9
},
"signature_type": "Line",
"target": {
"file": "drivers/nvdimm/label.c"
}
}
]