{"id":"CVE-2025-38442","state":"PUBLISHED","title":"block: reject bs > ps block devices when THP is disabled","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: reject bs > ps block devices when THP is disabled\n\nIf THP is disabled and when a block device with logical block size >\npage size is present, the following null ptr deref panic happens during\nboot:\n\n[   [13.2 mK  AOSAN: null-ptr-deref in range [0x0000000000000000-0x0000000000K0 0 0[07]\n[   13.017749] RIP: 0010:create_empty_buffers+0x3b/0x380\n<snip>\n[   13.025448] Call Trace:\n[   13.025692]  <TASK>\n[   13.025895]  block_read_full_folio+0x610/0x780\n[   13.026379]  ? __pfx_blkdev_get_block+0x10/0x10\n[   13.027008]  ? __folio_batch_add_and_move+0x1fa/0x2b0\n[   13.027548]  ? __pfx_blkdev_read_folio+0x10/0x10\n[   13.028080]  filemap_read_folio+0x9b/0x200\n[   13.028526]  ? __pfx_filemap_read_folio+0x10/0x10\n[   13.029030]  ? __filemap_get_folio+0x43/0x620\n[   13.029497]  do_read_cache_folio+0x155/0x3b0\n[   13.029962]  ? __pfx_blkdev_read_folio+0x10/0x10\n[   13.030381]  read_part_sector+0xb7/0x2a0\n[   13.030805]  read_lba+0x174/0x2c0\n<snip>\n[   13.045348]  nvme_scan_ns+0x684/0x850 [nvme_core]\n[   13.045858]  ? __pfx_nvme_scan_ns+0x10/0x10 [nvme_core]\n[   13.046414]  ? _raw_spin_unlock+0x15/0x40\n[   13.046843]  ? __switch_to+0x523/0x10a0\n[   13.047253]  ? kvm_clock_get_cycles+0x14/0x30\n[   13.047742]  ? __pfx_nvme_scan_ns_async+0x10/0x10 [nvme_core]\n[   13.048353]  async_run_entry_fn+0x96/0x4f0\n[   13.048787]  process_one_work+0x667/0x10a0\n[   13.049219]  worker_thread+0x63c/0xf60\n\nAs large folio support depends on THP, only allow bs > ps block devices\nif THP is enabled.","publishedAt":"2025-07-25T15:27:26.009Z","updatedAt":"2026-05-11T21:28:05.220Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"47dd67532303803a87f43195e088b3b4bcf0454d","status":"affected","lessThan":"b025d81b96bfe8a62b6e3e6ac776608206ccbf6d","versionType":"git"},{"version":"47dd67532303803a87f43195e088b3b4bcf0454d","status":"affected","lessThan":"4cdf1bdd45ac78a088773722f009883af30ad318","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/blkdev.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.15.7","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/blkdev.h"]}],"references":["https://git.kernel.org/stable/c/b025d81b96bfe8a62b6e3e6ac776608206ccbf6d","https://git.kernel.org/stable/c/4cdf1bdd45ac78a088773722f009883af30ad318"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38442.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38442","state":"PUBLISHED","datePublished":"2025-07-25T15:27:26.009Z","dateUpdated":"2026-05-11T21:28:05.220Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:24.016Z"},"containers":{"cna":{"title":"block: reject bs > ps block devices when THP is disabled","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: reject bs > ps block devices when THP is disabled\n\nIf THP is disabled and when a block device with logical block size >\npage size is present, the following null ptr deref panic happens during\nboot:\n\n[   [13.2 mK  AOSAN: null-ptr-deref in range [0x0000000000000000-0x0000000000K0 0 0[07]\n[   13.017749] RIP: 0010:create_empty_buffers+0x3b/0x380\n<snip>\n[   13.025448] Call Trace:\n[   13.025692]  <TASK>\n[   13.025895]  block_read_full_folio+0x610/0x780\n[   13.026379]  ? __pfx_blkdev_get_block+0x10/0x10\n[   13.027008]  ? __folio_batch_add_and_move+0x1fa/0x2b0\n[   13.027548]  ? __pfx_blkdev_read_folio+0x10/0x10\n[   13.028080]  filemap_read_folio+0x9b/0x200\n[   13.028526]  ? __pfx_filemap_read_folio+0x10/0x10\n[   13.029030]  ? __filemap_get_folio+0x43/0x620\n[   13.029497]  do_read_cache_folio+0x155/0x3b0\n[   13.029962]  ? __pfx_blkdev_read_folio+0x10/0x10\n[   13.030381]  read_part_sector+0xb7/0x2a0\n[   13.030805]  read_lba+0x174/0x2c0\n<snip>\n[   13.045348]  nvme_scan_ns+0x684/0x850 [nvme_core]\n[   13.045858]  ? __pfx_nvme_scan_ns+0x10/0x10 [nvme_core]\n[   13.046414]  ? _raw_spin_unlock+0x15/0x40\n[   13.046843]  ? __switch_to+0x523/0x10a0\n[   13.047253]  ? kvm_clock_get_cycles+0x14/0x30\n[   13.047742]  ? __pfx_nvme_scan_ns_async+0x10/0x10 [nvme_core]\n[   13.048353]  async_run_entry_fn+0x96/0x4f0\n[   13.048787]  process_one_work+0x667/0x10a0\n[   13.049219]  worker_thread+0x63c/0xf60\n\nAs large folio support depends on THP, only allow bs > ps block devices\nif THP is enabled."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"47dd67532303803a87f43195e088b3b4bcf0454d","status":"affected","lessThan":"b025d81b96bfe8a62b6e3e6ac776608206ccbf6d","versionType":"git"},{"version":"47dd67532303803a87f43195e088b3b4bcf0454d","status":"affected","lessThan":"4cdf1bdd45ac78a088773722f009883af30ad318","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/blkdev.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.15.7","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/blkdev.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/b025d81b96bfe8a62b6e3e6ac776608206ccbf6d"},{"url":"https://git.kernel.org/stable/c/4cdf1bdd45ac78a088773722f009883af30ad318"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T21:28:05.220Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.15.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}