CVE-2025-40134
Description
In the Linux kernel, the following vulnerability has been resolved:
dm: fix NULL pointer dereference in __dm_suspend()
There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes:
BUG: kernel NULL pointer dereference, address: 0000000000000054 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50 Call Trace:
blk_mq_quiesce_queue+0x2c/0x50 dm_stop_queue+0xd/0x20 __dm_suspend+0x130/0x330 dm_suspend+0x11a/0x180 dev_suspend+0x27e/0x560 ctl_ioctl+0x4cf/0x850 dm_ctl_ioctl+0xd/0x20 vfs_ioctl+0x1d/0x50 __se_sys_ioctl+0x9b/0xc0 __x64_sys_ioctl+0x19/0x30 x64_sys_call+0x2c4a/0x4620 do_syscall_64+0x9e/0x1b0
The issue can be triggered as below:
T1 T2 dm_suspend table_load __dm_suspend dm_setup_md_queue dm_mq_init_request_queue blk_mq_init_allocated_queue => q->mq_ops = set->ops; (1) dm_stop_queue / dm_wait_for_completion => q->tag_set NULL pointer! (2) => q->tag_set = set; (3)
Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps.
Even when map is NULL, no I/O can reach any target because there is no table loaded; I/O submitted in this state will fail early in the DM layer. Skipping the table-dependent suspend logic in this case is safe and avoids NULL pointer dereferences.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Race condition in Linux kernel device mapper between suspend and table load leads to NULL pointer dereference and system crash.
Vulnerability
A race condition exists in the Linux kernel's device mapper (dm) subsystem between the __dm_suspend() function and table loading. When a suspend operation is invoked before a table load completes, the device mapper's request queue may not yet have its tag_set pointer initialized, leading to a NULL pointer dereference in blk_mq_quiesce_queue().
Exploitation
The vulnerability can be triggered by a local attacker with sufficient privileges to issue dmsetup ioctl calls. By racing a dm_suspend ioctl with a table_load ioctl, the attacker can cause the kernel to crash. No authentication is required beyond the ability to interact with the device mapper control interface, which typically requires root privileges.
Impact
A successful exploit results in a denial of service (system crash) due to a kernel NULL pointer dereference. The crash manifests as an Oops with a call trace culminating in blk_mq_wait_quiesce_done, as shown in the CVE description. When the table is not yet loaded, no I/O can reach any target, making the race window safe to skip the table-dependent suspend steps without affecting correct operation.
Mitigation
The fix involves adding a check for a valid table (map) before performing request-based suspend and waiting for target I/O. When the map is NULL, these steps are skipped, preventing the NULL pointer dereference. The patch has been applied to the Linux kernel stable branches, as referenced in commits [1], [2], [3], and [4]. Users should update their kernels to the latest stable versions that include this fix.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
89dc43ea6a20f30f95b7eda59a0e54bd8d7eaa802901b75e1846cafc4725c19ca45286669331c2dd8ca8b8d33a030c566Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
8- git.kernel.org/stable/c/19ca4528666990be376ac3eb6fe667b03db5324dnvd
- git.kernel.org/stable/c/30f95b7eda5966b81cb221bd569c0f095a068cf6nvd
- git.kernel.org/stable/c/331c2dd8ca8bad1a3ac10cce847ffb76158eece4nvd
- git.kernel.org/stable/c/846cafc4725ca727d94f9c4b5f789c1a7c8fb6fenvd
- git.kernel.org/stable/c/8d33a030c566e1f105cd5bf27f37940b6367f3benvd
- git.kernel.org/stable/c/9dc43ea6a20ff83fe9a5fe4be47ae0fbf2409b98nvd
- git.kernel.org/stable/c/a0e54bd8d7ea79127fe9920df3ae36f85e79ac7cnvd
- git.kernel.org/stable/c/a802901b75e13cc306f1b7ab0f062135c8034e9envd
News mentions
0No linked articles in our index yet.