CVE-2025-40147
Description
In the Linux kernel, the following vulnerability has been resolved:
blk-throttle: fix access race during throttle policy activation
On repeated cold boots we occasionally hit a NULL pointer crash in blk_should_throtl() when throttling is consulted before the throttle policy is fully enabled for the queue. Checking only q->td != NULL is insufficient during early initialization, so blkg_to_pd() for the throttle policy can still return NULL and blkg_to_tg() becomes NULL, which later gets dereferenced.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000156 ... pc : submit_bio_noacct+0x14c/0x4c8 lr : submit_bio_noacct+0x48/0x4c8 sp : ffff800087f0b690 x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a Call trace: submit_bio_noacct+0x14c/0x4c8 verity_map+0x178/0x2c8 __map_bio+0x228/0x250 dm_submit_bio+0x1c4/0x678 __submit_bio+0x170/0x230 submit_bio_noacct_nocheck+0x16c/0x388 submit_bio_noacct+0x16c/0x4c8 submit_bio+0xb4/0x210 f2fs_submit_read_bio+0x4c/0xf0 f2fs_mpage_readpages+0x3b0/0x5f0 f2fs_readahead+0x90/0xe8
Tighten blk_throtl_activated() to also require that the throttle policy bit is set on the queue:
return q->td != NULL && test_bit(blkcg_policy_throtl.plid, q->blkcg_pols);
This prevents blk_should_throtl() from accessing throttle group state until policy data has been attached to blkgs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A race condition in Linux kernel's blk-throttle can cause a NULL pointer dereference when throttling is accessed before policy activation.
Vulnerability
Description
A race condition exists in the Linux kernel's block layer throttling (blk-throttle) during policy activation. When a block queue is initialized, the throttle policy data (q->td) may be set before the per-block-group policy data (blkg_to_pd) is fully attached. The function blk_should_throtl() only checked for q->td != NULL, which is insufficient. This allows a NULL pointer dereference when blkg_to_tg() returns NULL and the result is dereferenced, leading to a kernel crash [1].
Exploitation
The vulnerability is triggered during early initialization on cold boots, as described in the crash report. An attacker would need to be able to trigger I/O operations that go through the block layer throttling code before the throttle policy is fully enabled. This could be achieved by mounting filesystems (e.g., F2FS) or using device-mapper targets (e.g., dm-verity) that submit bios early in the boot process. No special privileges are required beyond the ability to cause block I/O, making it exploitable from user space or during boot.
Impact
Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (denial of service). The crash trace shows the dereference occurs in submit_bio_noacct, called from various I/O paths. This can lead to system instability or a complete hang, affecting availability.
Mitigation
The fix is included in the Linux kernel stable tree as commit bd9fd5be6bc0 [1]. The patch tightens the check in blk_throtl_activated() to also require that the throttle policy bit is set on the queue (test_bit(blkcg_policy_throtl.plid, q->blkcg_pols)). Users should apply the latest kernel updates from their distribution. No workaround is mentioned.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
37b4bfd02c9346a0c394300a7bd9fd5be6bc0Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.