CVE-2025-39791: In the Linux kernel, the following vulnerability has been resolved: dm: dm-crypt: Do not partially accept write BIOs with zoned targets Read and write…

PriorityP423medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.12%

2.0th percentile

In the Linux kernel, the following vulnerability has been resolved: dm: dm-crypt: Do not partially accept write BIOs with zoned targets Read and write operations issued to a dm-crypt target may be split according to the dm-crypt internal limits defined by the max_read_size and max_write_size module parameters (default is 128 KB). The intent is to improve processing time of large BIOs by splitting them into smaller operations that can be parallelized on different CPUs. For zoned dm-crypt targets, this BIO splitting is still done but without the parallel execution to ensure that the issuing order of write operations to the underlying devices remains sequential. However, the splitting itself causes other problems: 1) Since dm-crypt relies on the block layer zone write plugging to handle zone append emulation using regular write operations, the reminder of a split write BIO will always be plugged into the target zone write plugged. Once the on-going write BIO finishes, this reminder BIO is unplugged and issued from the zone write plug work. If this reminder BIO itself needs to be split, the reminder will be re-issued and plugged again, but that causes a call to a blk_queue_enter(), which may block if a queue freeze operation was initiated. This results in a deadlock as DM submission still holds BIOs that the queue freeze side is waiting for. 2) dm-crypt relies on the emulation done by the block layer using regular write operations for processing zone append operations. This still requires to properly return the written sector as the BIO sector of the original BIO. However, this can be done correctly only and only if there is a single clone BIO used for processing the original zone append operation issued by the user. If the size of a zone append operation is larger than dm-crypt max_write_size, then the orginal BIO will be split and processed as a chain of regular write operations. Such chaining result in an incorrect written sector being returned to the zone appen

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.16.5-1 (forky)	linux 6.16.5-1 (forky)
linux	linux	—	—
linux	linux	>= f211268ed1f9bdf48f06a3ead5f5d88437450579 < 8864616719b6bbf92356bc89ff544b0cd484c656	8864616719b6bbf92356bc89ff544b0cd484c656
linux	linux	>= f211268ed1f9bdf48f06a3ead5f5d88437450579 < 52a2c4c60470352acf9cde7a2dfa661c1e67e796	52a2c4c60470352acf9cde7a2dfa661c1e67e796
linux	linux	>= f211268ed1f9bdf48f06a3ead5f5d88437450579 < e549663849e5bb3b985dc2d293069f0d9747ae72	e549663849e5bb3b985dc2d293069f0d9747ae72
linux	linux_kernel	>= 0 < 6.12.48-1	6.12.48-1
linux	linux_kernel	>= 0 < 6.16.5-1	6.16.5-1
linux	linux_kernel	>= 6.10 < 6.12.44	6.12.44
linux	linux_kernel	>= 6.13 < 6.16.4	6.16.4

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5LOW

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.