CVE-2025-40147: blk-throttle: fix access race during throttle policy activation

Published Nov 12, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

blk-throttle: fix access race during throttle policy activation

On repeated cold boots we occasionally hit a NULL pointer crash in blkshouldthrotl() when throttling is consulted before the throttle policy is fully enabled for the queue. Checking only q->td != NULL is insufficient during early initialization, so blkgtopd() for the throttle policy can still return NULL and blkgtotg() becomes NULL, which later gets dereferenced.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000156 ... pc : submitbionoacct+0x14c/0x4c8 lr : submitbionoacct+0x48/0x4c8 sp : ffff800087f0b690 x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a Call trace: submitbionoacct+0x14c/0x4c8 veritymap+0x178/0x2c8 mapbio+0x228/0x250 dmsubmitbio+0x1c4/0x678 submitbio+0x170/0x230 submitbionoacctnocheck+0x16c/0x388 submitbionoacct+0x16c/0x4c8 submitbio+0xb4/0x210 f2fssubmitreadbio+0x4c/0xf0 f2fsmpagereadpages+0x3b0/0x5f0 f2fsreadahead+0x90/0xe8

Tighten blkthrotlactivated() to also require that the throttle policy bit is set on the queue:

return q->td != NULL && testbit(blkcgpolicythrotl.plid, q->blkcgpols);

This prevents blkshouldthrotl() from accessing throttle group state until policy data has been attached to blkgs.

Affected Software

2 affected componentsFixes available

Linux Linux kernel

debian/linux

6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.4-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1

Event History

Nov 12, 2025

CVE Published

via MITRE·10:23 AM

Data Sourced

via MITRE·10:23 AM

Description

Data Sourced

via NVD·11:15 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-6238

Frequently Asked Questions

What is the severity of CVE-2025-40147?

CVE-2025-40147 has been classified with a moderate severity due to the potential for a NULL pointer dereference leading to crashes in the Linux kernel.

How do I fix CVE-2025-40147?

To fix CVE-2025-40147, update to the latest stable version of the Linux kernel that includes the patch for this vulnerability.

Which versions of the Linux kernel are affected by CVE-2025-40147?

CVE-2025-40147 affects specific versions of the Linux kernel that have not received the patch to address the NULL pointer dereference issue.

What are the potential impacts of CVE-2025-40147?

The potential impacts of CVE-2025-40147 include system instability and crashes during the throttling process on repeated cold boots.

Is there ongoing support for CVE-2025-40147?

Yes, ongoing support is provided through updates from the Linux kernel development community to address CVE-2025-40147.