CVE-2025-39940

A flaw was found in the way the Linux kernel’s device-mapper stripe (dm-stripe) module handles I/O hint calculations. When processing a stripe’s chunk size that is excessively large, an integer overflow may occur in the stripe_io_hints function. If this overflow is not detected, the kernel may incorrectly set the limits->io_min and limits->io_opt values, leading to potential system instability or denial of service when the device-mapper subsystem processes I/O operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the dm_stripe kernel module from loading if device mapper stripe targets are not in use. This can be achieved by creating a modprobe configuration file.

1. Create a file named /etc/modprobe.d/disable-dm-stripe.conf with the following content:

install dm_stripe /bin/true
blacklist dm_stripe

2. Reboot the system for the changes to take effect.

Note that disabling this module may impact functionality if device mapper stripe targets are actively used on the system.