GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40147 (GCVE-0-2025-40147)

Vulnerability from cvelistv5 – Published: 2025-11-12 10:23 – Updated: 2026-05-11 21:43
VLAI
Title
blk-throttle: fix access race during throttle policy activation
Summary
In the Linux kernel, the following vulnerability has been resolved: blk-throttle: fix access race during throttle policy activation On repeated cold boots we occasionally hit a NULL pointer crash in blk_should_throtl() when throttling is consulted before the throttle policy is fully enabled for the queue. Checking only q->td != NULL is insufficient during early initialization, so blkg_to_pd() for the throttle policy can still return NULL and blkg_to_tg() becomes NULL, which later gets dereferenced. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000156 ... pc : submit_bio_noacct+0x14c/0x4c8 lr : submit_bio_noacct+0x48/0x4c8 sp : ffff800087f0b690 x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a Call trace: submit_bio_noacct+0x14c/0x4c8 verity_map+0x178/0x2c8 __map_bio+0x228/0x250 dm_submit_bio+0x1c4/0x678 __submit_bio+0x170/0x230 submit_bio_noacct_nocheck+0x16c/0x388 submit_bio_noacct+0x16c/0x4c8 submit_bio+0xb4/0x210 f2fs_submit_read_bio+0x4c/0xf0 f2fs_mpage_readpages+0x3b0/0x5f0 f2fs_readahead+0x90/0xe8 Tighten blk_throtl_activated() to also require that the throttle policy bit is set on the queue: return q->td != NULL && test_bit(blkcg_policy_throtl.plid, q->blkcg_pols); This prevents blk_should_throtl() from accessing throttle group state until policy data has been attached to blkgs.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a3166c51702bb00b8f8b84022090cbab8f37be1a , < 7b4bfd02c934dbbb18814ed012ecb90b58db6935 (git)
Affected: a3166c51702bb00b8f8b84022090cbab8f37be1a , < 6a0c394300a7b0c05504596685de8a46707171fc (git)
Affected: a3166c51702bb00b8f8b84022090cbab8f37be1a , < bd9fd5be6bc0836820500f68fff144609fbd85a9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c",
            "block/blk-cgroup.h",
            "block/blk-throttle.c",
            "block/blk-throttle.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b4bfd02c934dbbb18814ed012ecb90b58db6935",
              "status": "affected",
              "version": "a3166c51702bb00b8f8b84022090cbab8f37be1a",
              "versionType": "git"
            },
            {
              "lessThan": "6a0c394300a7b0c05504596685de8a46707171fc",
              "status": "affected",
              "version": "a3166c51702bb00b8f8b84022090cbab8f37be1a",
              "versionType": "git"
            },
            {
              "lessThan": "bd9fd5be6bc0836820500f68fff144609fbd85a9",
              "status": "affected",
              "version": "a3166c51702bb00b8f8b84022090cbab8f37be1a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c",
            "block/blk-cgroup.h",
            "block/blk-throttle.c",
            "block/blk-throttle.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-throttle: fix access race during throttle policy activation\n\nOn repeated cold boots we occasionally hit a NULL pointer crash in\nblk_should_throtl() when throttling is consulted before the throttle\npolicy is fully enabled for the queue. Checking only q-\u003etd != NULL is\ninsufficient during early initialization, so blkg_to_pd() for the\nthrottle policy can still return NULL and blkg_to_tg() becomes NULL,\nwhich later gets dereferenced.\n\n Unable to handle kernel NULL pointer dereference\n at virtual address 0000000000000156\n ...\n pc : submit_bio_noacct+0x14c/0x4c8\n lr : submit_bio_noacct+0x48/0x4c8\n sp : ffff800087f0b690\n x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0\n x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70\n x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000\n x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff\n x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff\n x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c\n x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60\n x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002\n x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500\n x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a\n Call trace:\n  submit_bio_noacct+0x14c/0x4c8\n  verity_map+0x178/0x2c8\n  __map_bio+0x228/0x250\n  dm_submit_bio+0x1c4/0x678\n  __submit_bio+0x170/0x230\n  submit_bio_noacct_nocheck+0x16c/0x388\n  submit_bio_noacct+0x16c/0x4c8\n  submit_bio+0xb4/0x210\n  f2fs_submit_read_bio+0x4c/0xf0\n  f2fs_mpage_readpages+0x3b0/0x5f0\n  f2fs_readahead+0x90/0xe8\n\nTighten blk_throtl_activated() to also require that the throttle policy\nbit is set on the queue:\n\n  return q-\u003etd != NULL \u0026\u0026\n         test_bit(blkcg_policy_throtl.plid, q-\u003eblkcg_pols);\n\nThis prevents blk_should_throtl() from accessing throttle group state\nuntil policy data has been attached to blkgs."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:43:38.854Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b4bfd02c934dbbb18814ed012ecb90b58db6935"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a0c394300a7b0c05504596685de8a46707171fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd9fd5be6bc0836820500f68fff144609fbd85a9"
        }
      ],
      "title": "blk-throttle: fix access race during throttle policy activation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40147",
    "datePublished": "2025-11-12T10:23:26.556Z",
    "dateReserved": "2025-04-16T07:20:57.175Z",
    "dateUpdated": "2026-05-11T21:43:38.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40147",
      "date": "2026-09-17",
      "epss": "0.00244",
      "percentile": "0.15764"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40147\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-11-12T11:15:44.600\",\"lastModified\":\"2026-06-17T09:21:20.287\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-throttle: fix access race during throttle policy activation\\n\\nOn repeated cold boots we occasionally hit a NULL pointer crash in\\nblk_should_throtl() when throttling is consulted before the throttle\\npolicy is fully enabled for the queue. Checking only q-\u003etd != NULL is\\ninsufficient during early initialization, so blkg_to_pd() for the\\nthrottle policy can still return NULL and blkg_to_tg() becomes NULL,\\nwhich later gets dereferenced.\\n\\n Unable to handle kernel NULL pointer dereference\\n at virtual address 0000000000000156\\n ...\\n pc : submit_bio_noacct+0x14c/0x4c8\\n lr : submit_bio_noacct+0x48/0x4c8\\n sp : ffff800087f0b690\\n x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0\\n x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70\\n x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000\\n x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff\\n x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff\\n x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c\\n x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60\\n x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002\\n x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500\\n x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a\\n Call trace:\\n  submit_bio_noacct+0x14c/0x4c8\\n  verity_map+0x178/0x2c8\\n  __map_bio+0x228/0x250\\n  dm_submit_bio+0x1c4/0x678\\n  __submit_bio+0x170/0x230\\n  submit_bio_noacct_nocheck+0x16c/0x388\\n  submit_bio_noacct+0x16c/0x4c8\\n  submit_bio+0xb4/0x210\\n  f2fs_submit_read_bio+0x4c/0xf0\\n  f2fs_mpage_readpages+0x3b0/0x5f0\\n  f2fs_readahead+0x90/0xe8\\n\\nTighten blk_throtl_activated() to also require that the throttle policy\\nbit is set on the queue:\\n\\n  return q-\u003etd != NULL \u0026\u0026\\n         test_bit(blkcg_policy_throtl.plid, q-\u003eblkcg_pols);\\n\\nThis prevents blk_should_throtl() from accessing throttle group state\\nuntil policy data has been attached to blkgs.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/blk-cgroup.c\",\"block/blk-cgroup.h\",\"block/blk-throttle.c\",\"block/blk-throttle.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a3166c51702bb00b8f8b84022090cbab8f37be1a\",\"lessThan\":\"7b4bfd02c934dbbb18814ed012ecb90b58db6935\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3166c51702bb00b8f8b84022090cbab8f37be1a\",\"lessThan\":\"6a0c394300a7b0c05504596685de8a46707171fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3166c51702bb00b8f8b84022090cbab8f37be1a\",\"lessThan\":\"bd9fd5be6bc0836820500f68fff144609fbd85a9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"block/blk-cgroup.c\",\"block/blk-cgroup.h\",\"block/blk-throttle.c\",\"block/blk-throttle.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.78\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.3\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6a0c394300a7b0c05504596685de8a46707171fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7b4bfd02c934dbbb18814ed012ecb90b58db6935\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bd9fd5be6bc0836820500f68fff144609fbd85a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T10:31:26+00:00",
      "cve": "CVE-2025-40147",
      "id": "CVE-2025-40147",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: blk-throttle: fix access race during throttle policy activation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40147.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.