CVE-2025-40125

An error handling oversight was found in the Linux kernel's block multiqueue subsystem when managing hardware queue sysfs entries. A local user can trigger this issue when sysfs registration fails for hardware queues but later operations attempt to unregister them. Since the unregistration code doesn't verify whether sysfs creation succeeded, it tries to delete nonexistent kobject entries, causing kernfs warnings and potential system instability or denial of service.

Block devices with multiple hardware queues create sysfs entries for each queue. The __blk_mq_update_nr_hw_queues function calls blk_mq_sysfs_register_hctxs without checking its return value. If sysfs creation fails for some queues, those kobjects never get added to sysfs. Later, when changing queue counts or removing the disk, blk_mq_unregister_hctx unconditionally calls kobject_del on all queues. For queues where sysfs creation failed, this tries to remove entries that don't exist, triggering kernfs errors. The fix checks state_in_sysfs before attempting deletion, skipping kobjects that were never successfully added to sysfs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.