Log in Start free

Vulnerability · Published Nov 12, 2025 · Assigned by Linux

CVE-2025-40147blk-throttle: fix access race during throttle policy activation

Unrated

In plain English

A security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS )–Not rated
Exploit odds (30 days)0.3%top 82.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: blk-throttle: fix access race during throttle policy activation On repeated cold boots we occasionally hit a NULL pointer crash in blk_should_throtl() when throttling is consulted before the throttle policy is fully enabled for the queue. Checking only q->td != NULL is insufficient during early initialization, so blkg_to_pd() for the throttle policy can still return NULL and blkg_to_tg() becomes NULL, which later gets dereferenced. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000156 ... pc : submit_bio_noacct+0x14c/0x4c8 lr : submit_bio_noacct+0x48/0x4c8 sp : ffff800087f0b690 x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a Call trace: submit_bio_noacct+0x14c/0x4c8 verity_map+0x178/0x2c8 __map_bio+0x228/0x250 dm_submit_bio+0x1c4/0x678 __submit_bio+0x170/0x230 submit_bio_noacct_nocheck+0x16c/0x388 submit_bio_noacct+0x16c/0x4c8 submit_bio+0xb4/0x210 f2fs_submit_read_bio+0x4c/0xf0 f2fs_mpage_readpages+0x3b0/0x5f0 f2fs_readahead+0x90/0xe8 Tighten blk_throtl_activated() to also require that the throttle policy bit is set on the queue: return q->td != NULL && test_bit(blkcg_policy_throtl.plid, q->blkcg_pols); This prevents blk_should_throtl() from accessing throttle group state until policy data has been attached to blkgs.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.85-1DEBIAN-CVE-2025-40147
Debian:14linux6.17.6-1DEBIAN-CVE-2025-40147
Ubuntu:25.10linux6.17.0-14.14UBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-40147
Ubuntu:25.10linux-aws6.17.0-1007.7UBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-aws-6.176.17.0-1007.7~24.04.1UBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-40147
Ubuntu:25.10linux-azure6.17.0-1008.8UBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-40147
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2025-40147
Ubuntu:25.10linux-gcp6.17.0-1007.7UBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1008.8~24.04.1UBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-nvidia-6.176.17.0-1008.8UBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1011.11UBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2025-40147
Ubuntu:25.10linux-oracle6.17.0-1007.7UBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1007.7~24.04.1UBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-40147
Ubuntu:25.10linux-raspi6.17.0-1008.8UBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-40147
Ubuntu:25.10linux-realtime6.17.0-1006.7UBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-40147
Ubuntu:25.10linux-riscv6.17.0-14.14.1UBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-40147
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-40147
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-40147

Affected products (as reported)

VendorProductVersions
Linux Linux a3166c51702bb00b8f8b84022090cbab8f37be1a – before 7b4bfd02c934dbbb18814ed012ecb90b58db6935a3166c51702bb00b8f8b84022090cbab8f37be1a – before 6a0c394300a7b0c05504596685de8a46707171fca3166c51702bb00b8f8b84022090cbab8f37be1a – before bd9fd5be6bc0836820500f68fff144609fbd85a9
Linux Linux 6.10

References