In the Linux kernel, the following vulnerability has been resolved:
blk-mq: check kobject stateinsysfs before deleting in blkmqunregister_hctx
In _blkmqupdatenrhwqueues() the return value of blkmqsysfsregisterhctxs() is not checked. If sysfs creation for hctx fails, later changing the number of hw_queues or removing disk will trigger the following warning:
kernfs: can not remove 'nrtags', no directory WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfsremovebynamens+0x13f/0x160 Call Trace: removefiles.isra.1+0x38/0xb0 sysfsremovegroup+0x4d/0x100 sysfsremovegroups+0x31/0x60 _kobjectdel+0x23/0xf0 kobjectdel+0x17/0x40 blkmqunregisterhctx+0x5d/0x80 blkmqsysfsunregisterhctxs+0x94/0xd0 blkmqupdatenrhwqueues+0x124/0x760 nullbupdatenrhwqueues+0x71/0xf0 [nullblk] nullbdevicesubmitqueuesstore+0x92/0x120 [null_blk]
kobjct_del() was called unconditionally even if sysfs creation failed. Fix it by checkig the kobject creation statusbefore deleting it.
[
{
"id": "CVE-2025-40125-057bf36d",
"signature_version": "v1",
"digest": {
"function_hash": "186895527950842492563995433010674971956",
"length": 203.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@babc634e9fe2803962dba98a07587e835dbc0731",
"target": {
"file": "block/blk-mq-sysfs.c",
"function": "blk_mq_unregister_hctx"
}
},
{
"id": "CVE-2025-40125-0a793066",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68058416207314834781845185387376538195",
"126784704767750922485035241944387751633",
"160643642218156213253118431317858860234",
"156234173156552314460895195557861783175",
"47984008017972725801721816348203539860"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e7dadc5763c48eb3b9b91265a21f312599ebb2c",
"target": {
"file": "block/blk-mq-sysfs.c"
}
},
{
"id": "CVE-2025-40125-30c4fab9",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68058416207314834781845185387376538195",
"126784704767750922485035241944387751633",
"160643642218156213253118431317858860234",
"156234173156552314460895195557861783175",
"47984008017972725801721816348203539860"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ddd76ee52bdc16e9f8b1e7791291e785dab032",
"target": {
"file": "block/blk-mq-sysfs.c"
}
},
{
"id": "CVE-2025-40125-3dfa76bb",
"signature_version": "v1",
"digest": {
"function_hash": "186895527950842492563995433010674971956",
"length": 203.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ddd76ee52bdc16e9f8b1e7791291e785dab032",
"target": {
"file": "block/blk-mq-sysfs.c",
"function": "blk_mq_unregister_hctx"
}
},
{
"id": "CVE-2025-40125-4920ee29",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68058416207314834781845185387376538195",
"126784704767750922485035241944387751633",
"160643642218156213253118431317858860234",
"156234173156552314460895195557861783175",
"47984008017972725801721816348203539860"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8c53553f1833cc2d14175d2d72cf37193a01898",
"target": {
"file": "block/blk-mq-sysfs.c"
}
},
{
"id": "CVE-2025-40125-53b6ce6f",
"signature_version": "v1",
"digest": {
"function_hash": "186895527950842492563995433010674971956",
"length": 203.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e7dadc5763c48eb3b9b91265a21f312599ebb2c",
"target": {
"file": "block/blk-mq-sysfs.c",
"function": "blk_mq_unregister_hctx"
}
},
{
"id": "CVE-2025-40125-60f0d512",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68058416207314834781845185387376538195",
"126784704767750922485035241944387751633",
"160643642218156213253118431317858860234",
"156234173156552314460895195557861783175",
"47984008017972725801721816348203539860"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc14ea21c4e658814d737ed4dedde6cd626a15ad",
"target": {
"file": "block/blk-mq-sysfs.c"
}
},
{
"id": "CVE-2025-40125-7969fdb5",
"signature_version": "v1",
"digest": {
"function_hash": "186895527950842492563995433010674971956",
"length": 203.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b97e99b87a773d52699521d40864f3ec888e9a6",
"target": {
"file": "block/blk-mq-sysfs.c",
"function": "blk_mq_unregister_hctx"
}
},
{
"id": "CVE-2025-40125-a4885340",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68058416207314834781845185387376538195",
"126784704767750922485035241944387751633",
"160643642218156213253118431317858860234",
"156234173156552314460895195557861783175",
"47984008017972725801721816348203539860"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@babc634e9fe2803962dba98a07587e835dbc0731",
"target": {
"file": "block/blk-mq-sysfs.c"
}
},
{
"id": "CVE-2025-40125-a7e9c0a4",
"signature_version": "v1",
"digest": {
"function_hash": "186895527950842492563995433010674971956",
"length": 203.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8c53553f1833cc2d14175d2d72cf37193a01898",
"target": {
"file": "block/blk-mq-sysfs.c",
"function": "blk_mq_unregister_hctx"
}
},
{
"id": "CVE-2025-40125-c06e1018",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68058416207314834781845185387376538195",
"126784704767750922485035241944387751633",
"160643642218156213253118431317858860234",
"156234173156552314460895195557861783175",
"47984008017972725801721816348203539860"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed",
"target": {
"file": "block/blk-mq-sysfs.c"
}
},
{
"id": "CVE-2025-40125-c8433864",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68058416207314834781845185387376538195",
"126784704767750922485035241944387751633",
"160643642218156213253118431317858860234",
"156234173156552314460895195557861783175",
"47984008017972725801721816348203539860"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b97e99b87a773d52699521d40864f3ec888e9a6",
"target": {
"file": "block/blk-mq-sysfs.c"
}
},
{
"id": "CVE-2025-40125-d542c943",
"signature_version": "v1",
"digest": {
"function_hash": "186895527950842492563995433010674971956",
"length": 203.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed",
"target": {
"file": "block/blk-mq-sysfs.c",
"function": "blk_mq_unregister_hctx"
}
},
{
"id": "CVE-2025-40125-dd1f3f14",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"68058416207314834781845185387376538195",
"126784704767750922485035241944387751633",
"160643642218156213253118431317858860234",
"156234173156552314460895195557861783175",
"47984008017972725801721816348203539860"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06c4826b1d900611096e4621e93133db57e13911",
"target": {
"file": "block/blk-mq-sysfs.c"
}
},
{
"id": "CVE-2025-40125-eab64e2c",
"signature_version": "v1",
"digest": {
"function_hash": "186895527950842492563995433010674971956",
"length": 203.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc14ea21c4e658814d737ed4dedde6cd626a15ad",
"target": {
"file": "block/blk-mq-sysfs.c",
"function": "blk_mq_unregister_hctx"
}
},
{
"id": "CVE-2025-40125-fc3590d4",
"signature_version": "v1",
"digest": {
"function_hash": "186895527950842492563995433010674971956",
"length": 203.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06c4826b1d900611096e4621e93133db57e13911",
"target": {
"file": "block/blk-mq-sysfs.c",
"function": "blk_mq_unregister_hctx"
}
}
]