PT-2025-27726 · Linux+5 · Linux Kernel+5

Published 2025-04-10 · Updated 2026-05-26 · CVE-2025-38140

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A vulnerability in the Linux kernel has been resolved, related to the device-mapper (dm) and its handling of zoned devices with zone write plugs. The issue arises when the dm revalidate zones() function fails to correctly update the zoned settings for a device, potentially leading to errors due to invalid memory access. The vulnerability is related to the blk revalidate disk zones() function, which may not correctly update the device's zoned settings if the device already has zone write plug resources. The estimated number of potentially affected devices worldwide is not available.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

AZL-64595

AZL-70642

BDU:2025-14093

CVE-2025-38140

ECHO-DAA6-BAC5-6971

OPENSUSE-SU-2025:20081-1

SUSE-SU-2025:21074-1

SUSE-SU-2025:21139-1

SUSE-SU-2025:21179-1

USN-7769-1

USN-7769-2

USN-7769-3

USN-7770-1

USN-7771-1

USN-7789-1

USN-7789-2

Affected Products

Astra Linux

Debian

Linuxmint

Linux Kernel

Suse

Ubuntu

References · 1471

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38140.json · Exploit
• https://ubuntu.com/security/CVE-2025-38272 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7769-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38064 · Vendor Advisory
• https://git.kernel.org/stable/c/ac8acb0bfd98a1c65f3ca9a3e217a766124eebd8 · Patch
• https://osv.dev/vulnerability/USN-7770-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38036 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:21139-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38137 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38315 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38414 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38108 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38051 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38082 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38281 · Vendor Advisory