Answer in brief
CVE-2025-38072 records a Medium severity (CVSS 5.5) vulnerability in libnvdimm/labels: Fix divide error in nd_label_data_init(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=7d47aad4570e5e6e9a8162bb417ca9b74132f27c <2bd4a938d2eda96ab7288b8fa5aae84a1de8c4ca || >=7d47aad4570e5e6e9a8162bb417ca9b74132f27c <396c46d3f59a18ebcc500640e749f16e197d472b || >=7d47aad4570e5e6e9a8162bb417ca9b74132f27c <f49c337037df029440a8390380dd35d2cf5924d3 || >=7d47aad4570e5e6e9a8162bb417ca9b74132f27c <db1aef51b8e66a77f76b1250b914589c31a0a0ed || >=7d47aad4570e5e6e9a8162bb417ca9b74132f27c <ea3d95e05e97ea20fd6513f647393add16fce3b2 || >=7d47aad4570e5e6e9a8162bb417ca9b74132f27c <1d1e1efad1cf049e888bf175a5c6be85d792620c || >=7d47aad4570e5e6e9a8162bb417ca9b74132f27c <e14347f647ca6d76fe1509b6703e340f2d5e2716 || >=7d47aad4570e5e6e9a8162bb417ca9b74132f27c <ef1d3455bbc1922f94a91ed58d3d7db440652959 | 2bd4a938d2eda96ab7288b8fa5aae84a1de8c4ca, 396c46d3f59a18ebcc500640e749f16e197d472b, f49c337037df029440a8390380dd35d2cf5924d3, db1aef51b8e66a77f76b1250b914589c31a0a0ed, ea3d95e05e97ea20fd6513f647393add16fce3b2, 1d1e1efad1cf049e888bf175a5c6be85d792620c, e14347f647ca6d76fe1509b6703e340f2d5e2716, ef1d3455bbc1922f94a91ed58d3d7db440652959 |
| Linux/Linuxgeneric | 4.20 | Not reported |
Published upstream
Jun 18, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 5, 2026
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide error in nd_label_data_init() If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver: Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] Code and flow: 1) CXL Command 4000h returns LSA size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver): drivers/cxl/pmem.c: .config_size = mds->lsa_size, 3) max_xfer is set to zero (nvdimm driver): drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size); 4) A subsequent DIV_ROUND_UP() causes a division by zero: drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer, drivers/nvdimm/label.c- config_size); Fix this by checking the config size parameter by extending an existing check.
Quoted source text, attributed separately from HOL analysis.