CVE-2025-40147 in Linux
Summary
by MITRE • 11/12/2025
In the Linux kernel, the following vulnerability has been resolved:
blk-throttle: fix access race during throttle policy activation
On repeated cold boots we occasionally hit a NULL pointer crash in blk_should_throtl() when throttling is consulted before the throttle policy is fully enabled for the queue. Checking only q->td != NULL is insufficient during early initialization, so blkg_to_pd() for the throttle policy can still return NULL and blkg_to_tg() becomes NULL, which later gets dereferenced.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000156 ... pc : submit_bio_noacct+0x14c/0x4c8 lr : submit_bio_noacct+0x48/0x4c8 sp : ffff800087f0b690 x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a Call trace: submit_bio_noacct+0x14c/0x4c8 verity_map+0x178/0x2c8 __map_bio+0x228/0x250 dm_submit_bio+0x1c4/0x678 __submit_bio+0x170/0x230 submit_bio_noacct_nocheck+0x16c/0x388 submit_bio_noacct+0x16c/0x4c8 submit_bio+0xb4/0x210 f2fs_submit_read_bio+0x4c/0xf0 f2fs_mpage_readpages+0x3b0/0x5f0 f2fs_readahead+0x90/0xe8
Tighten blk_throtl_activated() to also require that the throttle policy bit is set on the queue:
return q->td != NULL && test_bit(blkcg_policy_throtl.plid, q->blkcg_pols);
This prevents blk_should_throtl() from accessing throttle group state until policy data has been attached to blkgs.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 02/15/2026
The vulnerability described in CVE-2025-40147 resides within the Linux kernel's block layer throttling subsystem, specifically in how the kernel handles throttle policy activation during system initialization or repeated cold boots. This issue manifests as a NULL pointer dereference in the `blk_should_throtl()` function, which occurs when the kernel attempts to consult throttling policies before they are fully initialized for a given I/O queue. The root cause lies in an insufficient validation check that only verifies whether `q->td` is not NULL, without ensuring that the throttle policy has been properly attached to the queue's blkcg policies. This oversight allows for a race condition where `blkg_to_pd()` and `blkg_to_tg()` functions can return NULL values, leading to subsequent dereference of NULL pointers during I/O submission operations.
The technical flaw directly impacts the kernel's block layer throttling mechanism, which is designed to control I/O bandwidth for cgroups and ensure fair resource allocation across different I/O operations. During early system initialization or cold boot scenarios, when the kernel is rapidly processing I/O requests, the timing window between when the throttle data structure is allocated and when the policy bit is set can result in a critical race condition. This condition is particularly dangerous because it occurs during the submission of I/O operations, where the kernel attempts to determine whether a given I/O request should be throttled based on policy settings. The crash trace shows the execution path leading to the NULL pointer dereference through `submit_bio_noacct()` and eventually `verity_map()` and `f2fs_submit_read_bio()`, indicating that the issue affects filesystem operations that rely on block layer throttling.
This vulnerability presents a significant operational impact, particularly in environments where systems undergo frequent reboots or where block layer throttling is actively used for resource management. The NULL pointer dereference results in immediate kernel panic, causing system instability and potential data loss. The issue affects systems running Linux kernels that implement the block layer throttling subsystem, making it relevant to server environments, cloud infrastructure, and any system relying on cgroup-based I/O control. The vulnerability is classified as a race condition that can lead to denial of service conditions, where normal system operations are disrupted due to kernel crashes. This type of vulnerability aligns with CWE-362, which describes race conditions in kernel-level code, and can be mapped to ATT&CK technique T1499.001 for system network denial of service through kernel-level disruptions.
The fix implemented addresses the race condition by tightening the validation logic in `blk_throtl_activated()` to ensure that not only is the throttle data structure present but also that the throttle policy bit has been properly set within the queue's blkcg policies. This additional check prevents `blk_should_throtl()` from accessing throttle group state until the policy data has been fully attached to blkgs, thereby eliminating the window where NULL pointers could be dereferenced. The solution aligns with the principle of defensive programming by ensuring proper initialization sequence before accessing potentially uninitialized resources. This mitigation approach follows established kernel development practices for handling race conditions in concurrent systems and ensures that I/O throttling policies are properly synchronized with the underlying block layer state, preventing both the immediate crash and potential exploitation scenarios that could arise from such a condition.