In the Linux kernel, the following vulnerability has been resolved:
dm array: fix releasing a faulty array block twice in dm_array_cursor_end
When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().
Reproduce steps:
1. initialize a cache device
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
2. wipe the second array block offline
dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2>/dev/null | hexdump -e '1/8 "%u\n"') ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2>/dev/null | hexdump -e '1/8 "%u\n"') dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock
3. try reopen the cache device
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
Kernel logs:
(snip) device-mapper: array: array_block_check failed: blocknr 0 != wanted 10 device-mapper: block manager: array validator check failed for block 10 device-mapper: array: get_ablock failed device-mapper: cache metadata: dm_array_cursor_next for mapping failed ------------[ cut here ]------------ kernel BUG at drivers/md/dm-bufio.c:638!
Fix by setting the cached block pointer to NULL on errors.
In addition to the reproducer described above, this fix can be verified using the "array_cursor/damaged" test in dm-unit: dm-unit run /pdata/array_cursor/damaged --kernel-dir <KERNEL_DIR>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade bpftoolUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.234-225.895Upgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.178-120.178Upgrade kernel-debuginfoUpgrade python-perfUpgrade kernel-headersUpgrade bpftool-debuginfo | Mar 14, 2025 | Jan 19, 2025 |
| Amazon_linux_2023 | — | Upgrade bpftool-debuginfoUpgrade kernel-livepatch-6.1.127-135.201Upgrade kernel-develUpgrade perfUpgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade bpftoolUpgrade perf-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-develUpgrade kernel-libbpf-staticUpgrade kernel-libbpf-develUpgrade kernel-libbpfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-headers | Mar 27, 2025 | Jan 19, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Feb 10, 2025 | Jan 19, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libs | Jun 13, 2025 | Jan 19, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelists | Jul 21, 2025 | Jan 19, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade bpftool | Jul 1, 2025 | Jan 19, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | May 15, 2025 | Jan 19, 2025 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1084-azureUpgrade linux-image-oem-22.04Upgrade linux-image-fipsUpgrade linux-image-5.4.0-211-lowlatencyUpgrade linux-image-nvidia-tegraUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-6.11.0-21-genericUpgrade linux-image-5.15.0-1081-gcpUpgrade linux-image-6.11.0-1011-awsUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1145-gcp-fipsUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-136-generic-lpaeUpgrade linux-image-generic-64kUpgrade linux-image-gkeopUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.4.0-1088-ibmUpgrade linux-image-5.15.0-1083-azure-fipsUpgrade linux-image-6.8.0-60-lowlatencyUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-6.8.0-1028-nvidia-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1029-azureUpgrade linux-image-6.8.0-1025-gkeUpgrade linux-image-6.8.0-60-lowlatency-64kUpgrade linux-image-5.15.0-1077-oracleUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gkeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.11.0-1010-raspiUpgrade linux-image-6.8.0-1029-azure-fdeUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-5.15.0-1074-nvidiaUpgrade linux-image-bluefieldUpgrade linux-image-5.15.0-1075-intel-iotgUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-6.8.0-1026-ibmUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-6.11.0-1011-gcpUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1147-azure-fipsUpgrade linux-image-5.15.0-1074-raspiUpgrade linux-image-realtimeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.4.0-1090-ibmUpgrade linux-image-5.15.0-1086-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1080-awsUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.15.0-135-genericUpgrade linux-image-5.4.0-1129-kvmUpgrade linux-image-5.4.0-1147-azureUpgrade linux-image-5.4.0-1142-aws-fipsUpgrade linux-image-6.8.0-1026-oracleUpgrade linux-image-5.15.0-1072-ibmUpgrade linux-image-5.15.0-1073-intel-iot-realtimeUpgrade linux-image-oem-24.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1028-nvidiaUpgrade linux-image-aws-fipsUpgrade linux-image-5.4.0-211-generic-lpaeUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-5.15.0-1079-gcpUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-genericUpgrade linux-image-oemUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-60-generic-64kUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-gkeop-5.15Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-5.4.0-1142-awsUpgrade linux-image-oem-20.04cUpgrade linux-image-oracleUpgrade linux-image-oem-20.04bUpgrade linux-image-oem-osp1Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-gcp-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-5.15.0-1077-gkeUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1030-gcp-64kUpgrade linux-image-5.15.0-135-lowlatency-64kUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-intelUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1028-nvidia-lowlatencyUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-gke-5.15Upgrade linux-image-raspi-nolpaeUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-5.4.0-1060-xilinx-zynqmpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-135-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-azure-fipsUpgrade linux-image-5.15.0-1080-aws-fipsUpgrade linux-image-6.11.0-21-generic-64kUpgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-oem-24.04aUpgrade linux-image-5.15.0-135-generic-64kUpgrade linux-image-5.15.0-136-genericUpgrade linux-image-6.11.0-1011-gcp-64kUpgrade linux-image-raspiUpgrade linux-image-kvmUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-ibm-classicUpgrade linux-image-oem-24.04bUpgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-raspi-realtimeUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.11.0-1013-oracleUpgrade linux-image-6.8.0-1026-oracle-64kUpgrade linux-image-azure-lts-20.04Upgrade linux-image-6.8.0-1030-gcpUpgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-6.8.1-1022-realtimeUpgrade linux-image-awsUpgrade linux-image-6.8.0-1029-awsUpgrade linux-image-ibmUpgrade linux-image-5.15.0-136-generic-64kUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-azure-fdeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.11.0-1012-azure-fdeUpgrade linux-image-5.4.0-211-genericUpgrade linux-image-5.15.0-135-fipsUpgrade linux-image-5.15.0-1079-gcp-fipsUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64kUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1062-gkeopUpgrade linux-image-6.8.0-1012-gkeopUpgrade linux-image-5.4.0-1145-gcpUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-5.15.0-1074-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.8.0-60-genericUpgrade linux-image-5.15.0-1077-intel-iotgUpgrade linux-image-azure-lts-24.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1028-nvidia-64kUpgrade linux-image-6.11.0-1012-azureUpgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-5.15.0-1086-azure-fdeUpgrade linux-image-5.15.0-1080-realtimeUpgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.4.0-1140-oracleUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-6.11.0-1013-oracle-64kUpgrade linux-image-raspi2Upgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1028-oemUpgrade linux-image-5.15.0-135-generic-lpaeUpgrade linux-image-gcp-fipsUpgrade linux-image-azureUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-6.8.0-1016-azure-nvidiaUpgrade linux-image-6.11.0-1017-oemUpgrade linux-image-6.11.0-1007-realtimeUpgrade linux-image-5.4.0-1101-bluefieldUpgrade linux-image-oem-20.04dUpgrade linux-image-lowlatencyUpgrade linux-image-gkeop-6.8 | Mar 28, 2025 | Jan 19, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jan 19, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub