Loading vulnerability…
Use-after-free in Linux kernel device-mapper zone reporting
CVE-2025-38141 is a use-after-free vulnerability in the Linux kernel device-mapper function dm_blk_report_zones(). During initial setup of zone append emulation resources, such as when creating a zoned dm-crypt table, blk_revalidate_disk_zones() can run concurrently with another process reporting zones. If revalidation fails, it can free resources that the concurrent zone-reporting operation is still using. The vulnerable implementation allows other processes to access the not-yet-activated table through md->zone_revalidate_map while the device is suspended. It also inconsistently reads this pointer and can omit required dm_put_live_table() calls, including when dm_get_live_table() returns NULL. The fix restricts access to the revalidation table to the process performing revalidation and corrects live-table handling.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes a kernel use-after-free, potentially resulting in a system crash or denial of service. A local attacker with low privileges could potentially escalate privileges or compromise the system, affecting confidentiality, integrity, and availability. Reliable arbitrary code execution is not established by the available information.
If you can’t patch tonight, do this now.
No specific workaround is documented. Pending patch deployment, restrict local access to trusted users and limit access to affected device-mapper block devices. These measures reduce exposure but do not correct the underlying race condition.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the dm_blk_report_zones() fix and reboot into the updated kernel. The patch tracks the process setting md->zone_revalidate_map in dm_revalidate_zones(), permits only that process to use the unactivated table during revalidation, reads the revalidation pointer consistently, and balances live-table acquisition and release. RHEL fixes include RHSA-2026:1143 for RHEL 9, RHSA-2026:4011 for RHEL 9.6 EUS with kernel 5.14.0-570.96.1.el9_6, RHSA-2026:4012 for RHEL 10, and RHSA-2026:6193 for RHEL 10.0 EUS with kernel 6.12.0-55.65.1.el10_0. SUSE users should install the product-specific fixed kernel packages; examples include kernel-default 6.12.0-160000.6.1 for SLES/openSUSE Leap 16.0-class products. Affected Juniper CTPView installations should be upgraded to 9.3R2-3 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.