cbcvebase.
CVE-2025-38263
published 2025-07-09

CVE-2025-38263: In the Linux kernel, the following vulnerability has been resolved: bcache: fix NULL pointer in cache_set_flush() 1. LINE#1794 - LINE#1887 is some codes about…

medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved: bcache: fix NULL pointer in cache_set_flush() 1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc(). 2. LINE#2078 - LINE#2142 is some codes about function of register_cache_set(). 3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098. 1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) 1795 { ... 1860 if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) || 1861 mempool_init_slab_pool(&c->search, 32, bch_search_cache) || 1862 mempool_init_kmalloc_pool(&c->bio_meta, 2, 1863 sizeof(struct bbio) + sizeof(struct bio_vec) * 1864 bucket_pages(c)) || 1865 mempool_init_kmalloc_pool(&c->fill_iter, 1, iter_size) || 1866 bioset_init(&c->bio_split, 4, offsetof(struct bbio, bio), 1867 BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) || 1868 !(c->uuids = alloc_bucket_pages(GFP_KERNEL, c)) || 1869 !(c->moving_gc_wq = alloc_workqueue("bcache_gc", 1870 WQ_MEM_RECLAIM, 0)) || 1871 bch_journal_alloc(c) || 1872 bch_btree_cache_alloc(c) || 1873 bch_open_buckets_alloc(c) || 1874 bch_bset_sort_state_init(&c->sort, ilog2(c->btree_pages))) 1875 goto err; ^^^^^^^^ 1876 ... 1883 return c; 1884 err: 1885 bch_cache_set_unregister(c); ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1886 return NULL; 1887 } ... 2078 static const char *register_cache_set(struct cache *ca) 2079 { ... 2098 c = bch_cache_set_alloc(&ca->sb); 2099 if (!c) 2100 return err; ^^^^^^^^^^ ... 2128 ca->set = c; 2129 ca->set->cache[ca->sb.nr_this_dev] = ca; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ... 2138 return NULL; 2139 err: 2140 bch_cache_set_unregister(c); 2141 return err; 2142 } (1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and call bch_cache_set_unregister()(LINE#1885). (2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return. (3) As (2) has returned, LINE#2128 - LINE#2129 would do *not* give the value to c->cache[], it means that c->cache[] is NULL. LINE#1624 - LINE#1665 is so

Affected

34 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
debianlinux-6.1< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
linuxlinux
linuxlinux>= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < d54681938b777488e5dfb781b566d16adad991ded54681938b777488e5dfb781b566d16adad991de
linuxlinux>= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 1f25f2d3fa29325320c19a30abf787e0bd5fc91b1f25f2d3fa29325320c19a30abf787e0bd5fc91b
linuxlinux>= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < c4f5e7e417034b05f5d2f5fa9a872db897da69bdc4f5e7e417034b05f5d2f5fa9a872db897da69bd
linuxlinux>= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 553f560e0a74a7008ad9dba05c3fd05da296befb553f560e0a74a7008ad9dba05c3fd05da296befb
linuxlinux>= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 667c3f52373ff5354cb3543e27237eb7df7b2333667c3f52373ff5354cb3543e27237eb7df7b2333
linuxlinux>= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 3f9e128186c99a117e304f1dce6d0b9e50c63cd83f9e128186c99a117e304f1dce6d0b9e50c63cd8
linuxlinux>= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 1e46ed947ec658f89f1a910d880cd05e42d3763e1e46ed947ec658f89f1a910d880cd05e42d3763e
linuxlinux_kernel>= 0 < 5.10.244-15.10.244-1
linuxlinux_kernel>= 0 < 6.1.147-16.1.147-1
linuxlinux_kernel>= 0 < 6.12.37-16.12.37-1
linuxlinux_kernel>= 0 < 6.12.37-16.12.37-1
linuxlinux_kernel>= 0 < 5.15.0-156.1665.15.0-156.166
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 3.10 < 5.10.2405.10.240
linuxlinux_kernel>= 5.11 < 5.15.1875.15.187
linuxlinux_kernel>= 5.16 < 6.1.1436.1.143
linuxlinux_kernel>= 6.13 < 6.15.56.15.5
linuxlinux_kernel>= 6.2 < 6.6.966.6.96
linuxlinux_kernel>= 6.7 < 6.12.366.12.36
msrcazl3_kernel_6.6.92.2-2_on_azure_linux_3.0
msrccbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.6MEDIUM