CVE-2025-38302: block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work
In the Linux kernel, the following vulnerability has been resolved:
block: don't use submitbionoacctnocheck in blkzonewplugbiowork
Bios queued up in the zone write plug have already gone through all all preparation in the submitbio path, including the freeze protection.
Submitting them through submitbionoacctnocheck duplicates the work and can can cause deadlocks when freezing a queue with pending bio write plugs.
Go straight to ->submitbio or blkmqsubmitbio to bypass the superfluous extra freeze protection and checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.35-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.34 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.15.3 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38302?
CVE-2025-38302 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38302?
To address CVE-2025-38302, it is recommended to update your Linux kernel to the latest version that contains the fix.
What systems are affected by CVE-2025-38302?
CVE-2025-38302 affects various versions of the Linux kernel.
What type of vulnerability is CVE-2025-38302?
CVE-2025-38302 is related to the block layer of the Linux kernel, specifically concerning bio submissions in zone write operations.
Is CVE-2025-38302 currently being exploited?
As of now, there is no public evidence indicating active exploitation of CVE-2025-38302.