In the Linux kernel, the following vulnerability has been resolved:
dm: fix NULL pointer dereference in _dmsuspend()
There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes:
BUG: kernel NULL pointer dereference, address: 0000000000000054 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:blkmqwaitquiescedone+0x0/0x50 Call Trace: <TASK> blkmqquiescequeue+0x2c/0x50 dmstopqueue+0xd/0x20 _dmsuspend+0x130/0x330 dmsuspend+0x11a/0x180 devsuspend+0x27e/0x560 ctlioctl+0x4cf/0x850 dmctlioctl+0xd/0x20 vfsioctl+0x1d/0x50 _sesysioctl+0x9b/0xc0 _x64sysioctl+0x19/0x30 x64syscall+0x2c4a/0x4620 dosyscall_64+0x9e/0x1b0
The issue can be triggered as below:
T1 T2 dmsuspend tableload _dmsuspend dmsetupmdqueue dmmqinitrequestqueue blkmqinitallocatedqueue => q->mqops = set->ops; (1) dmstopqueue / dmwaitforcompletion => q->tagset NULL pointer! (2) => q->tag_set = set; (3)
Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps.
Even when map is NULL, no I/O can reach any target because there is no table loaded; I/O submitted in this state will fail early in the DM layer. Skipping the table-dependent suspend logic in this case is safe and avoids NULL pointer dereferences.
[
{
"id": "CVE-2025-40134-166965a3",
"target": {
"file": "drivers/md/dm.c",
"function": "__dm_suspend"
},
"digest": {
"function_hash": "286460473951536334980909957731379473119",
"length": 1155.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a802901b75e13cc306f1b7ab0f062135c8034e9e",
"signature_version": "v1"
},
{
"id": "CVE-2025-40134-2b2d1861",
"target": {
"file": "drivers/md/dm.c",
"function": "__dm_suspend"
},
"digest": {
"function_hash": "286460473951536334980909957731379473119",
"length": 1155.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@846cafc4725ca727d94f9c4b5f789c1a7c8fb6fe",
"signature_version": "v1"
},
{
"id": "CVE-2025-40134-2fecce36",
"target": {
"file": "drivers/md/dm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"141395745800967660857692644022332201528",
"159245573245548054238475504160653986552",
"169833182151274406876093701112361472680",
"173928676073971854697675570578059135884",
"95222195881723591618131132963218652442",
"132669828577091322129302145427915865360",
"323233083119813423999234644337432333006",
"41161146039781119787906866247489452495",
"236444201613474211953930907477799021453",
"189995273666949633395425242583164668286",
"323330489110920816022280815187982978529",
"227876475857357742600983235785105888460"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@846cafc4725ca727d94f9c4b5f789c1a7c8fb6fe",
"signature_version": "v1"
},
{
"id": "CVE-2025-40134-ac4641b7",
"target": {
"file": "drivers/md/dm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"141395745800967660857692644022332201528",
"159245573245548054238475504160653986552",
"169833182151274406876093701112361472680",
"173928676073971854697675570578059135884",
"95222195881723591618131132963218652442",
"132669828577091322129302145427915865360",
"323233083119813423999234644337432333006",
"41161146039781119787906866247489452495",
"236444201613474211953930907477799021453",
"189995273666949633395425242583164668286",
"323330489110920816022280815187982978529",
"227876475857357742600983235785105888460"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a802901b75e13cc306f1b7ab0f062135c8034e9e",
"signature_version": "v1"
},
{
"id": "CVE-2025-40134-d9bd7510",
"target": {
"file": "drivers/md/dm.c",
"function": "__dm_suspend"
},
"digest": {
"function_hash": "247515824603865834824805727850143675125",
"length": 1059.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30f95b7eda5966b81cb221bd569c0f095a068cf6",
"signature_version": "v1"
},
{
"id": "CVE-2025-40134-ed3e1a9e",
"target": {
"file": "drivers/md/dm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"141395745800967660857692644022332201528",
"159245573245548054238475504160653986552",
"169833182151274406876093701112361472680",
"173928676073971854697675570578059135884",
"338497815588329310657643918014849730934",
"83895742754018846766792893811983328498",
"225911212082404533207826558182889461995",
"88336712286902788777242445998909445236",
"214758182540663724505238721463982664008",
"323330489110920816022280815187982978529",
"227876475857357742600983235785105888460"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30f95b7eda5966b81cb221bd569c0f095a068cf6",
"signature_version": "v1"
}
]