CVE-2025-38141

A flaw was found in the Linux kernel's device mapper (dm) component. When setting up zone append emulation resources, a race condition can occur if the blk_revalidate_disk_zones() function fails while another process simultaneously calls dm_blk_report_zones(). This timing issue can lead to a use-after-free error, potentially allowing a local attacker to achieve privilege escalation or cause a denial of service.

This vulnerability is rated as having a Moderate impact for Red Hat products because triggering the race condition requires local system access and specific timing during the initialization of zoned block device tables, which generally requires administrative privileges. Typical Red Hat Enterprise Linux deployments do not utilize zoned storage devices or zone append emulation, substantially limiting practical exposure in production environments. Even on systems where zoned targets are active, exploiting this memory corruption requires concurrently querying zone reports while target reconfiguration encounters a failure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.