CVE-2025-38263
published 2025-07-09CVE-2025-38263: In the Linux kernel, the following vulnerability has been resolved: bcache: fix NULL pointer in cache_set_flush() 1. LINE#1794 - LINE#1887 is some codes about…
medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved:
bcache: fix NULL pointer in cache_set_flush()
1. LINE#1794 - LINE#1887 is some codes about function of
bch_cache_set_alloc().
2. LINE#2078 - LINE#2142 is some codes about function of
register_cache_set().
3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098.
1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
1795 {
...
1860 if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) ||
1861 mempool_init_slab_pool(&c->search, 32, bch_search_cache) ||
1862 mempool_init_kmalloc_pool(&c->bio_meta, 2,
1863 sizeof(struct bbio) + sizeof(struct bio_vec) *
1864 bucket_pages(c)) ||
1865 mempool_init_kmalloc_pool(&c->fill_iter, 1, iter_size) ||
1866 bioset_init(&c->bio_split, 4, offsetof(struct bbio, bio),
1867 BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) ||
1868 !(c->uuids = alloc_bucket_pages(GFP_KERNEL, c)) ||
1869 !(c->moving_gc_wq = alloc_workqueue("bcache_gc",
1870 WQ_MEM_RECLAIM, 0)) ||
1871 bch_journal_alloc(c) ||
1872 bch_btree_cache_alloc(c) ||
1873 bch_open_buckets_alloc(c) ||
1874 bch_bset_sort_state_init(&c->sort, ilog2(c->btree_pages)))
1875 goto err;
^^^^^^^^
1876
...
1883 return c;
1884 err:
1885 bch_cache_set_unregister(c);
^^^^^^^^^^^^^^^^^^^^^^^^^^^
1886 return NULL;
1887 }
...
2078 static const char *register_cache_set(struct cache *ca)
2079 {
...
2098 c = bch_cache_set_alloc(&ca->sb);
2099 if (!c)
2100 return err;
^^^^^^^^^^
...
2128 ca->set = c;
2129 ca->set->cache[ca->sb.nr_this_dev] = ca;
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...
2138 return NULL;
2139 err:
2140 bch_cache_set_unregister(c);
2141 return err;
2142 }
(1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and
call bch_cache_set_unregister()(LINE#1885).
(2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return.
(3) As (2) has returned, LINE#2128 - LINE#2129 would do *not* give the
value to c->cache[], it means that c->cache[] is NULL.
LINE#1624 - LINE#1665 is so
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < d54681938b777488e5dfb781b566d16adad991de | d54681938b777488e5dfb781b566d16adad991de |
| linux | linux | >= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 1f25f2d3fa29325320c19a30abf787e0bd5fc91b | 1f25f2d3fa29325320c19a30abf787e0bd5fc91b |
| linux | linux | >= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < c4f5e7e417034b05f5d2f5fa9a872db897da69bd | c4f5e7e417034b05f5d2f5fa9a872db897da69bd |
| linux | linux | >= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 553f560e0a74a7008ad9dba05c3fd05da296befb | 553f560e0a74a7008ad9dba05c3fd05da296befb |
| linux | linux | >= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 667c3f52373ff5354cb3543e27237eb7df7b2333 | 667c3f52373ff5354cb3543e27237eb7df7b2333 |
| linux | linux | >= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 3f9e128186c99a117e304f1dce6d0b9e50c63cd8 | 3f9e128186c99a117e304f1dce6d0b9e50c63cd8 |
| linux | linux | >= cafe563591446cf80bfbc2fe3bc72a2e36cf1060 < 1e46ed947ec658f89f1a910d880cd05e42d3763e | 1e46ed947ec658f89f1a910d880cd05e42d3763e |
| linux | linux_kernel | >= 0 < 5.10.244-1 | 5.10.244-1 |
| linux | linux_kernel | >= 0 < 6.1.147-1 | 6.1.147-1 |
| linux | linux_kernel | >= 0 < 6.12.37-1 | 6.12.37-1 |
| linux | linux_kernel | >= 0 < 6.12.37-1 | 6.12.37-1 |
| linux | linux_kernel | >= 0 < 5.15.0-156.166 | 5.15.0-156.166 |
| linux | linux_kernel | >= 0 < 6.8.0-100.100 | 6.8.0-100.100 |
| linux | linux_kernel | >= 3.10 < 5.10.240 | 5.10.240 |
| linux | linux_kernel | >= 5.11 < 5.15.187 | 5.15.187 |
| linux | linux_kernel | >= 5.16 < 6.1.143 | 6.1.143 |
| linux | linux_kernel | >= 6.13 < 6.15.5 | 6.15.5 |
| linux | linux_kernel | >= 6.2 < 6.6.96 | 6.6.96 |
| linux | linux_kernel | >= 6.7 < 6.12.36 | 6.12.36 |
| msrc | azl3_kernel_6.6.92.2-2_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.6MEDIUM