CVE-2025-38072

libnvdimm/labels: Fix divide error in nd_label_data_init()

MEDIUM

5.5

CVSS Score

Published: June 18, 2025 at 09:33 AM UTC

Updated: June 17, 2026 at 09:15 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide error in nd_label_data_init() If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver: Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] Code and flow: 1) CXL Command 4000h returns LSA size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver): drivers/cxl/pmem.c: .config_size = mds->lsa_size, 3) max_xfer is set to zero (nvdimm driver): drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size); 4) A subsequent DIV_ROUND_UP() causes a division by zero: drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer, drivers/nvdimm/label.c- config_size); Fix this by checking the config size parameter by extending an existing check.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

v < 5.4.2944.20 ≤ v < 5.10.2384.20 ≤ v < 5.15.1854.20 ≤ v < 5.4.2944.20 ≤ v < 6.1.1414.20 ≤ v < 6.12.314.20 ≤ v < 6.14.94.20 ≤ v < 6.154.20 ≤ v < 6.6.935.11 ≤ v < 5.15.1855.16 ≤ v < 6.1.1415.5 ≤ v < 5.10.2386.13 ≤ v < 6.14.96.2 ≤ v < 6.6.936.7 ≤ v < 6.12.314.207d47aad4570e5e6e9a8162bb417ca9b74132f27c

Vendor states this is fixed in 1d1e1efad1cf049e888bf175a5c6be85d792620c (fixed)

Vendor states this is fixed in 2bd4a938d2eda96ab7288b8fa5aae84a1de8c4ca (fixed)

Vendor states this is fixed in 396c46d3f59a18ebcc500640e749f16e197d472b (fixed)

Vendor states this is fixed in db1aef51b8e66a77f76b1250b914589c31a0a0ed (fixed)

Vendor states this is fixed in e14347f647ca6d76fe1509b6703e340f2d5e2716 (fixed)

Vendor states this is fixed in ea3d95e05e97ea20fd6513f647393add16fce3b2 (fixed)

Vendor states this is fixed in ef1d3455bbc1922f94a91ed58d3d7db440652959 (fixed)

Vendor states this is fixed in f49c337037df029440a8390380dd35d2cf5924d3 (fixed)

Vendor states this is fixed in 4.20 (unaffected)

Vendor states this is fixed in 5.10.238 (unaffected)

Vendor states this is fixed in 5.15.185 (unaffected)

Vendor states this is fixed in 5.4.294 (unaffected)