CVE-2025-38072

In the Linux kernel, the following vulnerability has been resolved:

libnvdimm/labels: Fix divide error in nd_label_data_init()

If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver:

Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm]

Code and flow:

1. CXL Command 4000h returns LSA size = 0
2. config_size is assigned to zero LSA size (CXL pmem driver):

drivers/cxl/pmem.c: .config_size = mds->lsa_size,

3. max_xfer is set to zero (nvdimm driver):

drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size);

4. A subsequent DIV_ROUND_UP() causes a division by zero:

drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer, drivers/nvdimm/label.c- config_size);

Fix this by checking the config size parameter by extending an existing check.

This patch fixes a divide-by-zero bug in the nd_label_data_init() function of the libnvdimm subsystem. The issue occurs when a faulty or misbehaving CXL memory device reports a zero-sized Label Storage Area (LSA), resulting in division by zero during configuration setup. Because interaction with CXL memory devices and NVDIMM configuration requires administrative privileges (e.g., CAP_SYS_ADMIN), and the attack involves low-level device manipulation, the vulnerability is only exploitable by privileged users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module libnvdimm from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.