CVE-2025-40147
Lifecycle Timeline
2Description
In the Linux kernel, the following vulnerability has been resolved: blk-throttle: fix access race during throttle policy activation On repeated cold boots we occasionally hit a NULL pointer crash in blk_should_throtl() when throttling is consulted before the throttle policy is fully enabled for the queue. Checking only q->td != NULL is insufficient during early initialization, so blkg_to_pd() for the throttle policy can still return NULL and blkg_to_tg() becomes NULL, which later gets dereferenced. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000156 ... pc : submit_bio_noacct+0x14c/0x4c8 lr : submit_bio_noacct+0x48/0x4c8 sp : ffff800087f0b690 x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a Call trace: submit_bio_noacct+0x14c/0x4c8 verity_map+0x178/0x2c8 __map_bio+0x228/0x250 dm_submit_bio+0x1c4/0x678 __submit_bio+0x170/0x230 submit_bio_noacct_nocheck+0x16c/0x388 submit_bio_noacct+0x16c/0x4c8 submit_bio+0xb4/0x210 f2fs_submit_read_bio+0x4c/0xf0 f2fs_mpage_readpages+0x3b0/0x5f0 f2fs_readahead+0x90/0xe8 Tighten blk_throtl_activated() to also require that the throttle policy bit is set on the queue: return q->td != NULL && test_bit(blkcg_policy_throtl.plid, q->blkcg_pols); This prevents blk_should_throtl() from accessing throttle group state until policy data has been attached to blkgs.
Analysis
Linux kernel block I/O throttling subsystem crashes with a NULL pointer dereference when I/O operations are submitted during early initialization before throttle policy is fully activated, causing denial of service on affected systems. The vulnerability affects the block layer's throttle policy initialization sequence and is triggered sporadically on cold boots when blk_should_throtl() accesses uninitialized throttle group state. With an EPSS score of 0.03% (10th percentile) and no public exploit identified, this is a low-probability but high-impact local crash condition requiring a kernel patch to fully resolve.
Technical Context
The vulnerability resides in the Linux kernel's block I/O throttling subsystem (blk-throttle), specifically in the blk_throtl_activated() function which determines whether throttle policy is ready for use. The root cause is a time-of-check-time-of-use (TOCTOU) race condition in the initialization path: the code checks only whether q->td (throttle data structure) is non-NULL, but this check is insufficient because the throttle policy bit may not yet be set in the queue's active policy bitmap (q->blkcg_pols). Consequently, blkg_to_pd() and blkg_to_tg() can return NULL pointers during a narrow window when the queue descriptor exists but policy activation is incomplete. When submit_bio_noacct() or verity_map() subsequently calls blk_should_throtl(), it dereferences a NULL throttle group pointer at offset 0x156, triggering an oops. The fix tightens the activation check to require both q->td != NULL AND test_bit(blkcg_policy_throtl.plid, q->blkcg_pols), eliminating the race window by serializing policy visibility with bit-level attestation.
Affected Products
The Linux kernel in all versions using the block I/O throttling subsystem (blk-throttle) prior to application of the fix are affected. The vulnerability has been patched via three commits referenced in the kernel stable tree: 6a0c394300a7b0c05504596685de8a46707171fc, 7b4bfd02c934dbbb18814ed012ecb90b58db6935, and bd9fd5be6bc0836820500f68fff144609fbd85a9. No specific kernel version numbers are provided in the advisory data; affected versions span the range in which block throttling is active and cold-boot initialization races can occur. Users should verify patch incorporation in their kernel release notes or consult their distribution's security advisories. The vulnerability affects ARM64 systems (evidenced by the ARM call trace in the description) and likely x86_64 and other architectures with similar block I/O initialization sequences.
Remediation
Upgrade to a Linux kernel version that includes the block throttle initialization fix (commits 6a0c394300a7b0c05504596685de8a46707171fc, 7b4bfd02c934dbbb18814ed012ecb90b58db6935, or bd9fd5be6bc0836820500f68fff144609fbd85a9 or later). Consult your Linux distribution's security advisories and kernel release notes to identify the earliest stable release that incorporates this patch. Alternatively, apply the patch directly to your kernel tree from the stable Linux repository (git.kernel.org/stable). Until patching is feasible, mitigate cold-boot crashes by reducing frequency of system reboots and monitoring kernel logs for blk-throttle initialization oopses; however, no robust workaround eliminates the race window at runtime. Vendors using embedded Linux or custom kernels should prioritize patching their build pipelines to include the upstream fix in subsequent releases.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today