CVE-2025-38263 (GCVE-0-2025-38263)

Vulnerability from cvelistv5 – Published: 2025-07-09 10:42 – Updated: 2026-05-11 21:24
VLAI?
Title
bcache: fix NULL pointer in cache_set_flush()
Summary
In the Linux kernel, the following vulnerability has been resolved: bcache: fix NULL pointer in cache_set_flush() 1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc(). 2. LINE#2078 - LINE#2142 is some codes about function of register_cache_set(). 3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098. 1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) 1795 { ... 1860 if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) || 1861 mempool_init_slab_pool(&c->search, 32, bch_search_cache) || 1862 mempool_init_kmalloc_pool(&c->bio_meta, 2, 1863 sizeof(struct bbio) + sizeof(struct bio_vec) * 1864 bucket_pages(c)) || 1865 mempool_init_kmalloc_pool(&c->fill_iter, 1, iter_size) || 1866 bioset_init(&c->bio_split, 4, offsetof(struct bbio, bio), 1867 BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) || 1868 !(c->uuids = alloc_bucket_pages(GFP_KERNEL, c)) || 1869 !(c->moving_gc_wq = alloc_workqueue("bcache_gc", 1870 WQ_MEM_RECLAIM, 0)) || 1871 bch_journal_alloc(c) || 1872 bch_btree_cache_alloc(c) || 1873 bch_open_buckets_alloc(c) || 1874 bch_bset_sort_state_init(&c->sort, ilog2(c->btree_pages))) 1875 goto err; ^^^^^^^^ 1876 ... 1883 return c; 1884 err: 1885 bch_cache_set_unregister(c); ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1886 return NULL; 1887 } ... 2078 static const char *register_cache_set(struct cache *ca) 2079 { ... 2098 c = bch_cache_set_alloc(&ca->sb); 2099 if (!c) 2100 return err; ^^^^^^^^^^ ... 2128 ca->set = c; 2129 ca->set->cache[ca->sb.nr_this_dev] = ca; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ... 2138 return NULL; 2139 err: 2140 bch_cache_set_unregister(c); 2141 return err; 2142 } (1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and call bch_cache_set_unregister()(LINE#1885). (2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return. (3) As (2) has returned, LINE#2128 - LINE#2129 would do *not* give the value to c->cache[], it means that c->cache[] is NULL. LINE#1624 - LINE#1665 is some codes about function of cache_set_flush(). As (1), in LINE#1885 call bch_cache_set_unregister() ---> bch_cache_set_stop() ---> closure_queue() -.-> cache_set_flush() (as below LINE#1624) 1624 static void cache_set_flush(struct closure *cl) 1625 { ... 1654 for_each_cache(ca, c, i) 1655 if (ca->alloc_thread) ^^ 1656 kthread_stop(ca->alloc_thread); ... 1665 } (4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the kernel crash occurred as below: [ 846.712887] bcache: register_cache() error drbd6: cannot allocate memory [ 846.713242] bcache: register_bcache() error : failed to register device [ 846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered [ 846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8 [ 846.714790] PGD 0 P4D 0 [ 846.715129] Oops: 0000 [#1] SMP PTI [ 846.715472] CPU: 19 PID: 5057 Comm: kworker/19:16 Kdump: loaded Tainted: G OE --------- - - 4.18.0-147.5.1.el8_1.5es.3.x86_64 #1 [ 846.716082] Hardware name: ESPAN GI-25212/X11DPL-i, BIOS 2.1 06/15/2018 [ 846.716451] Workqueue: events cache_set_flush [bcache] [ 846.716808] RIP: 0010:cache_set_flush+0xc9/0x1b0 [bcache] [ 846.717155] Code: 00 4c 89 a5 b0 03 00 00 48 8b 85 68 f6 ff ff a8 08 0f 84 88 00 00 00 31 db 66 83 bd 3c f7 ff ff 00 48 8b 85 48 ff ff ff 74 28 <48> 8b b8 f8 09 00 0 ---truncated---
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < d54681938b777488e5dfb781b566d16adad991de (git)
Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < 1f25f2d3fa29325320c19a30abf787e0bd5fc91b (git)
Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < c4f5e7e417034b05f5d2f5fa9a872db897da69bd (git)
Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < 553f560e0a74a7008ad9dba05c3fd05da296befb (git)
Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < 667c3f52373ff5354cb3543e27237eb7df7b2333 (git)
Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < 3f9e128186c99a117e304f1dce6d0b9e50c63cd8 (git)
Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < 1e46ed947ec658f89f1a910d880cd05e42d3763e (git)
Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 5.10.240 , ≤ 5.10.* (semver)
Unaffected: 5.15.187 , ≤ 5.15.* (semver)
Unaffected: 6.1.143 , ≤ 6.1.* (semver)
Unaffected: 6.6.96 , ≤ 6.6.* (semver)
Unaffected: 6.12.36 , ≤ 6.12.* (semver)
Unaffected: 6.15.5 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:36:06.203Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/bcache/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d54681938b777488e5dfb781b566d16adad991de",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "1f25f2d3fa29325320c19a30abf787e0bd5fc91b",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "c4f5e7e417034b05f5d2f5fa9a872db897da69bd",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "553f560e0a74a7008ad9dba05c3fd05da296befb",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "667c3f52373ff5354cb3543e27237eb7df7b2333",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "3f9e128186c99a117e304f1dce6d0b9e50c63cd8",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "1e46ed947ec658f89f1a910d880cd05e42d3763e",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/bcache/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.143",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.96",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.36",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.5",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix NULL pointer in cache_set_flush()\n\n1. LINE#1794 - LINE#1887 is some codes about function of\n   bch_cache_set_alloc().\n2. LINE#2078 - LINE#2142 is some codes about function of\n   register_cache_set().\n3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098.\n\n 1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)\n 1795 {\n ...\n 1860         if (!(c-\u003edevices = kcalloc(c-\u003enr_uuids, sizeof(void *), GFP_KERNEL)) ||\n 1861             mempool_init_slab_pool(\u0026c-\u003esearch, 32, bch_search_cache) ||\n 1862             mempool_init_kmalloc_pool(\u0026c-\u003ebio_meta, 2,\n 1863                                 sizeof(struct bbio) + sizeof(struct bio_vec) *\n 1864                                 bucket_pages(c)) ||\n 1865             mempool_init_kmalloc_pool(\u0026c-\u003efill_iter, 1, iter_size) ||\n 1866             bioset_init(\u0026c-\u003ebio_split, 4, offsetof(struct bbio, bio),\n 1867                         BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) ||\n 1868             !(c-\u003euuids = alloc_bucket_pages(GFP_KERNEL, c)) ||\n 1869             !(c-\u003emoving_gc_wq = alloc_workqueue(\"bcache_gc\",\n 1870                                                 WQ_MEM_RECLAIM, 0)) ||\n 1871             bch_journal_alloc(c) ||\n 1872             bch_btree_cache_alloc(c) ||\n 1873             bch_open_buckets_alloc(c) ||\n 1874             bch_bset_sort_state_init(\u0026c-\u003esort, ilog2(c-\u003ebtree_pages)))\n 1875                 goto err;\n                      ^^^^^^^^\n 1876\n ...\n 1883         return c;\n 1884 err:\n 1885         bch_cache_set_unregister(c);\n              ^^^^^^^^^^^^^^^^^^^^^^^^^^^\n 1886         return NULL;\n 1887 }\n ...\n 2078 static const char *register_cache_set(struct cache *ca)\n 2079 {\n ...\n 2098         c = bch_cache_set_alloc(\u0026ca-\u003esb);\n 2099         if (!c)\n 2100                 return err;\n                      ^^^^^^^^^^\n ...\n 2128         ca-\u003eset = c;\n 2129         ca-\u003eset-\u003ecache[ca-\u003esb.nr_this_dev] = ca;\n              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n ...\n 2138         return NULL;\n 2139 err:\n 2140         bch_cache_set_unregister(c);\n 2141         return err;\n 2142 }\n\n(1) If LINE#1860 - LINE#1874 is true, then do \u0027goto err\u0027(LINE#1875) and\n    call bch_cache_set_unregister()(LINE#1885).\n(2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return.\n(3) As (2) has returned, LINE#2128 - LINE#2129 would do *not* give the\n    value to c-\u003ecache[], it means that c-\u003ecache[] is NULL.\n\nLINE#1624 - LINE#1665 is some codes about function of cache_set_flush().\nAs (1), in LINE#1885 call\nbch_cache_set_unregister()\n---\u003e bch_cache_set_stop()\n     ---\u003e closure_queue()\n          -.-\u003e cache_set_flush() (as below LINE#1624)\n\n 1624 static void cache_set_flush(struct closure *cl)\n 1625 {\n ...\n 1654         for_each_cache(ca, c, i)\n 1655                 if (ca-\u003ealloc_thread)\n                          ^^\n 1656                         kthread_stop(ca-\u003ealloc_thread);\n ...\n 1665 }\n\n(4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the\n    kernel crash occurred as below:\n[  846.712887] bcache: register_cache() error drbd6: cannot allocate memory\n[  846.713242] bcache: register_bcache() error : failed to register device\n[  846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered\n[  846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8\n[  846.714790] PGD 0 P4D 0\n[  846.715129] Oops: 0000 [#1] SMP PTI\n[  846.715472] CPU: 19 PID: 5057 Comm: kworker/19:16 Kdump: loaded Tainted: G           OE    --------- -  - 4.18.0-147.5.1.el8_1.5es.3.x86_64 #1\n[  846.716082] Hardware name: ESPAN GI-25212/X11DPL-i, BIOS 2.1 06/15/2018\n[  846.716451] Workqueue: events cache_set_flush [bcache]\n[  846.716808] RIP: 0010:cache_set_flush+0xc9/0x1b0 [bcache]\n[  846.717155] Code: 00 4c 89 a5 b0 03 00 00 48 8b 85 68 f6 ff ff a8 08 0f 84 88 00 00 00 31 db 66 83 bd 3c f7 ff ff 00 48 8b 85 48 ff ff ff 74 28 \u003c48\u003e 8b b8 f8 09 00 0\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:24:25.185Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d54681938b777488e5dfb781b566d16adad991de"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f25f2d3fa29325320c19a30abf787e0bd5fc91b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4f5e7e417034b05f5d2f5fa9a872db897da69bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/553f560e0a74a7008ad9dba05c3fd05da296befb"
        },
        {
          "url": "https://git.kernel.org/stable/c/667c3f52373ff5354cb3543e27237eb7df7b2333"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f9e128186c99a117e304f1dce6d0b9e50c63cd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e46ed947ec658f89f1a910d880cd05e42d3763e"
        }
      ],
      "title": "bcache: fix NULL pointer in cache_set_flush()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38263",
    "datePublished": "2025-07-09T10:42:37.990Z",
    "dateReserved": "2025-04-16T04:51:23.997Z",
    "dateUpdated": "2026-05-11T21:24:25.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38263",
      "date": "2026-05-20",
      "epss": "0.00066",
      "percentile": "0.2043"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38263\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-09T11:15:28.690\",\"lastModified\":\"2025-12-18T16:58:38.157\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbcache: fix NULL pointer in cache_set_flush()\\n\\n1. LINE#1794 - LINE#1887 is some codes about function of\\n   bch_cache_set_alloc().\\n2. LINE#2078 - LINE#2142 is some codes about function of\\n   register_cache_set().\\n3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098.\\n\\n 1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)\\n 1795 {\\n ...\\n 1860         if (!(c-\u003edevices = kcalloc(c-\u003enr_uuids, sizeof(void *), GFP_KERNEL)) ||\\n 1861             mempool_init_slab_pool(\u0026c-\u003esearch, 32, bch_search_cache) ||\\n 1862             mempool_init_kmalloc_pool(\u0026c-\u003ebio_meta, 2,\\n 1863                                 sizeof(struct bbio) + sizeof(struct bio_vec) *\\n 1864                                 bucket_pages(c)) ||\\n 1865             mempool_init_kmalloc_pool(\u0026c-\u003efill_iter, 1, iter_size) ||\\n 1866             bioset_init(\u0026c-\u003ebio_split, 4, offsetof(struct bbio, bio),\\n 1867                         BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) ||\\n 1868             !(c-\u003euuids = alloc_bucket_pages(GFP_KERNEL, c)) ||\\n 1869             !(c-\u003emoving_gc_wq = alloc_workqueue(\\\"bcache_gc\\\",\\n 1870                                                 WQ_MEM_RECLAIM, 0)) ||\\n 1871             bch_journal_alloc(c) ||\\n 1872             bch_btree_cache_alloc(c) ||\\n 1873             bch_open_buckets_alloc(c) ||\\n 1874             bch_bset_sort_state_init(\u0026c-\u003esort, ilog2(c-\u003ebtree_pages)))\\n 1875                 goto err;\\n                      ^^^^^^^^\\n 1876\\n ...\\n 1883         return c;\\n 1884 err:\\n 1885         bch_cache_set_unregister(c);\\n              ^^^^^^^^^^^^^^^^^^^^^^^^^^^\\n 1886         return NULL;\\n 1887 }\\n ...\\n 2078 static const char *register_cache_set(struct cache *ca)\\n 2079 {\\n ...\\n 2098         c = bch_cache_set_alloc(\u0026ca-\u003esb);\\n 2099         if (!c)\\n 2100                 return err;\\n                      ^^^^^^^^^^\\n ...\\n 2128         ca-\u003eset = c;\\n 2129         ca-\u003eset-\u003ecache[ca-\u003esb.nr_this_dev] = ca;\\n              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\\n ...\\n 2138         return NULL;\\n 2139 err:\\n 2140         bch_cache_set_unregister(c);\\n 2141         return err;\\n 2142 }\\n\\n(1) If LINE#1860 - LINE#1874 is true, then do \u0027goto err\u0027(LINE#1875) and\\n    call bch_cache_set_unregister()(LINE#1885).\\n(2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return.\\n(3) As (2) has returned, LINE#2128 - LINE#2129 would do *not* give the\\n    value to c-\u003ecache[], it means that c-\u003ecache[] is NULL.\\n\\nLINE#1624 - LINE#1665 is some codes about function of cache_set_flush().\\nAs (1), in LINE#1885 call\\nbch_cache_set_unregister()\\n---\u003e bch_cache_set_stop()\\n     ---\u003e closure_queue()\\n          -.-\u003e cache_set_flush() (as below LINE#1624)\\n\\n 1624 static void cache_set_flush(struct closure *cl)\\n 1625 {\\n ...\\n 1654         for_each_cache(ca, c, i)\\n 1655                 if (ca-\u003ealloc_thread)\\n                          ^^\\n 1656                         kthread_stop(ca-\u003ealloc_thread);\\n ...\\n 1665 }\\n\\n(4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the\\n    kernel crash occurred as below:\\n[  846.712887] bcache: register_cache() error drbd6: cannot allocate memory\\n[  846.713242] bcache: register_bcache() error : failed to register device\\n[  846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered\\n[  846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8\\n[  846.714790] PGD 0 P4D 0\\n[  846.715129] Oops: 0000 [#1] SMP PTI\\n[  846.715472] CPU: 19 PID: 5057 Comm: kworker/19:16 Kdump: loaded Tainted: G           OE    --------- -  - 4.18.0-147.5.1.el8_1.5es.3.x86_64 #1\\n[  846.716082] Hardware name: ESPAN GI-25212/X11DPL-i, BIOS 2.1 06/15/2018\\n[  846.716451] Workqueue: events cache_set_flush [bcache]\\n[  846.716808] RIP: 0010:cache_set_flush+0xc9/0x1b0 [bcache]\\n[  846.717155] Code: 00 4c 89 a5 b0 03 00 00 48 8b 85 68 f6 ff ff a8 08 0f 84 88 00 00 00 31 db 66 83 bd 3c f7 ff ff 00 48 8b 85 48 ff ff ff 74 28 \u003c48\u003e 8b b8 f8 09 00 0\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bcache: arregla el puntero NULL en cache_set_flush() 1. L\u00cdNEA#1794 - L\u00cdNEA#1887 son algunos c\u00f3digos sobre la funci\u00f3n de bch_cache_set_alloc(). 2. L\u00cdNEA#2078 - L\u00cdNEA#2142 son algunos c\u00f3digos sobre la funci\u00f3n de register_cache_set(). 3. register_cache_set() llamar\u00e1 a bch_cache_set_alloc() en la L\u00cdNEA#2098. 1794 estructura cach\u00e9_set *bch_cache_set_alloc(estructura cach\u00e9_sb *sb) 1795 { ... 1860 si (!(c-\u0026gt;dispositivos = kcalloc(c-\u0026gt;nr_uuids, tama\u00f1o de(void *), GFP_KERNEL)) || 1861 mempool_init_slab_pool(\u0026amp;c-\u0026gt;b\u00fasqueda, 32, bch_b\u00fasqueda_cache) || 1862 mempool_init_kmalloc_pool(\u0026amp;c-\u0026gt;bio_meta, 2, 1863 tama\u00f1o de(estructura bbio) + tama\u00f1o de(estructura bio_vec) * 1864 p\u00e1ginas_de_dep\u00f3sito(c)) || 1865 mempool_init_kmalloc_pool(\u0026amp;c-\u0026gt;rellenar_iter, 1, tama\u00f1o_de_iter) || 1866 bioset_init(\u0026amp;c-\u0026gt;bio_split, 4, offsetof(struct bbio, bio), 1867 BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) || 1868 !(c-\u0026gt;uuids = alloc_bucket_pages(GFP_KERNEL, c)) || 1869 !(c-\u0026gt;moving_gc_wq = alloc_workqueue(\\\"bcache_gc\\\", 1870 WQ_MEM_RECLAIM, 0)) || 1871 bch_journal_alloc(c) || 1872 bch_btree_cache_alloc(c) || 1873 bch_open_buckets_alloc(c) || 1874 bch_bset_sort_state_init(\u0026amp;c-\u0026gt;sort, ilog2(c-\u0026gt;btree_pages))) 1875 goto err; ^^^^^^^^ 1876 ... 1883 devolver c; 1884 err: 1885 bch_cache_set_unregister(c); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1886 devolver NULL; 1887 } ... 2078 static const char *register_cache_set(struct cache *ca) 2079 { ... 2098 c = bch_cache_set_alloc(\u0026amp;ca-\u0026gt;sb); 2099 if (!c) 2100 devolver err; ^^^^^^^^^^ ... 2128 ca-\u0026gt;set = c; 2129 ca-\u0026gt;set-\u0026gt;cache[ca-\u0026gt;sb.nr_this_dev] = ca; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^... 2138 return NULL; 2139 err: 2140 bch_cache_set_unregister(c); 2141 return err; 2142 } (1) Si L\u00cdNEA#1860 - L\u00cdNEA#1874 es verdadero, entonces haga \u0027goto err\u0027(L\u00cdNEA#1875) y llame a bch_cache_set_unregister()(L\u00cdNEA#1885). (2) Como (1) devuelve NULL(L\u00cdNEA#1886), L\u00cdNEA#2098 - L\u00cdNEA#2100 retornar\u00eda. (3) Como (2) ha retornado, la L\u00cdNEA n.\u00ba 2128 - L\u00cdNEA n.\u00ba 2129 *no* dar\u00eda el valor a c-\u0026gt;cache[], lo que significa que c-\u0026gt;cache[] es NULL. LA L\u00cdNEA n.\u00ba 1624 - L\u00cdNEA n.\u00ba 1665 son algunos c\u00f3digos sobre la funci\u00f3n de cache_set_flush(). Como (1), en la L\u00cdNEA n.\u00ba 1885 llame a bch_cache_set_unregister() ---\u0026gt; bch_cache_set_stop() ---\u0026gt; closure_queue() -.-\u0026gt; cache_set_flush() (como se muestra a continuaci\u00f3n en la L\u00cdNEA n.\u00ba 1624) 1624 static void cache_set_flush(struct closure *cl) 1625 { ... 1654 for_each_cache(ca, c, i) 1655 if (ca-\u0026gt;alloc_thread) ^^ 1656 kthread_stop(ca-\u0026gt;alloc_thread); ... 1665 } (4) En la L\u00cdNEA n.\u00ba 1655 ca es NULL (ver (3)) en cache_set_flush(), entonces ocurri\u00f3 el fallo del n\u00facleo como se muestra a continuaci\u00f3n: [846.712887] bcache: error de register_cache() drbd6: no se puede asignar memoria [846.713242] bcache: error de register_bcache(): no se pudo registrar el dispositivo [846.713336] bcache: cache_set_free() Conjunto de cach\u00e9 2f84bdc1-498a-4f2f-98a7-01946bf54287 no registrado [846.713768] ERROR: no se puede manejar la desreferencia del puntero NULL del n\u00facleo en 00000000000009f8 [846.714790] PGD 0 P4D 0 [ 846.715129] Oops: 0000 [#1] SMP PTI [ 846.715472] CPU: 19 PID: 5057 Comm: kworker/19:16 Kdump: cargado Contaminado: G OE --------- - - 4.18.0-147.5.1.el8_1.5es.3.x86_64 #1 [ 846.716082] Nombre del hardware: ESPAN GI-25212/X11DPL-i, BIOS 2.1 15/06/2018 [ 846.716451] Cola de trabajo: eventos cache_set_flush [bcache] [ 846.716808] RIP: 0010:cache_set_flush+0xc9/0x1b0 [bcache] [ 846.717155] C\u00f3digo: 00 4c 89 a5 b0 03 00 00 48 8b 85 68 f6 ff ff a8 08 0f 84 88 00 00 00 31 db 66 83 bd 3c f7 ff ff 00 48 8b 85 48 ff ff ff 74 28 \u0026lt;48\u0026gt; 8b b8 f8 09 00 0 ---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10\",\"versionEndExcluding\":\"5.10.240\",\"matchCriteriaId\":\"089EF73B-7C46-4864-B04A-B4A310D2E17B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.187\",\"matchCriteriaId\":\"4BD28D29-423C-4173-9DB8-3BA14E9F665D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.143\",\"matchCriteriaId\":\"FC77EF56-FA90-40B6-AF3C-9BBE6D4BEAD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.96\",\"matchCriteriaId\":\"6AB3EB1A-48DE-47F4-9202-D0C58A0F6060\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.36\",\"matchCriteriaId\":\"2BD88DEC-018F-4F40-8E29-A2CA89813EBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.5\",\"matchCriteriaId\":\"0CC768E2-3BBC-4A6E-9C2F-ECB27A703C2D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1e46ed947ec658f89f1a910d880cd05e42d3763e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1f25f2d3fa29325320c19a30abf787e0bd5fc91b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3f9e128186c99a117e304f1dce6d0b9e50c63cd8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/553f560e0a74a7008ad9dba05c3fd05da296befb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/667c3f52373ff5354cb3543e27237eb7df7b2333\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c4f5e7e417034b05f5d2f5fa9a872db897da69bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d54681938b777488e5dfb781b566d16adad991de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"Mailing List\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.