{"id":66891,"date":"2025-07-28T17:33:36","date_gmt":"2025-07-28T14:03:36","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2025-38496-qemu-dm-bufio-preemption-vulnerability\/"},"modified":"2025-07-28T17:33:36","modified_gmt":"2025-07-28T14:03:36","slug":"cve-2025-38496-qemu-dm-bufio-preemption-vulnerability","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2025-38496-qemu-dm-bufio-preemption-vulnerability\/","title":{"rendered":"CVE-2025-38496 – QEMU dm-bufio Preemption Vulnerability"},"content":{"rendered":"

CVE ID : <\/strong>CVE-2025-38496
\n
\nPublished : <\/strong> July 28, 2025, 12:15 p.m. | 1\u00a0hour, 5\u00a0minutes ago
\n
\nDescription : <\/strong>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n

dm-bufio: fix sched in atomic context<\/p>\n

If “try_verify_in_tasklet” is set for dm-verity, DM_BUFIO_CLIENT_NO_SLEEP
\nis enabled for dm-bufio. However, when bufio tries to evict buffers, there
\nis a chance to trigger scheduling in spin_lock_bh, the following warning
\nis hit:<\/p>\n

BUG: sleeping function called from invalid context at drivers\/md\/dm-bufio.c:2745
\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 123, name: kworker\/2:2
\npreempt_count: 201, expected: 0
\nRCU nest depth: 0, expected: 0
\n4 locks held by kworker\/2:2\/123:
\n #0: ffff88800a2d1548 ((wq_completion)dm_bufio_cache){….}-{0:0}, at: process_one_work+0xe46\/0x1970
\n #1: ffffc90000d97d20 ((work_completion)(&dm_bufio_replacement_work)){….}-{0:0}, at: process_one_work+0x763\/0x1970
\n #2: ffffffff8555b528 (dm_bufio_clients_lock){….}-{3:3}, at: do_global_cleanup+0x1ce\/0x710
\n #3: ffff88801d5820b8 (&c->spinlock){….}-{2:2}, at: do_global_cleanup+0x2a5\/0x710
\nPreemption disabled at:
\n[] 0x0
\nCPU: 2 UID: 0 PID: 123 Comm: kworker\/2:2 Not tainted 6.16.0-rc3-g90548c634bd0 #305 PREEMPT(voluntary)
\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04\/01\/2014
\nWorkqueue: dm_bufio_cache do_global_cleanup
\nCall Trace:<\/p>\n

dump_stack_lvl+0x53\/0x70
\n __might_resched+0x360\/0x4e0
\n do_global_cleanup+0x2f5\/0x710
\n process_one_work+0x7db\/0x1970
\n worker_thread+0x518\/0xea0
\n kthread+0x359\/0x690
\n ret_from_fork+0xf3\/0x1b0
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n

That can be reproduced by:<\/p>\n

veritysetup format –data-block-size=4096 –hash-block-size=4096 \/dev\/vda \/dev\/vdb
\n SIZE=$(blockdev –getsz \/dev\/vda)
\n dmsetup create myverity -r –table “0 $SIZE verity 1 \/dev\/vda \/dev\/vdb 4096 4096 1 sha256 1 try_verify_in_tasklet”
\n mount \/dev\/dm-0 \/mnt -o ro
\n echo 102400 > \/sys\/module\/dm_bufio\/parameters\/max_cache_size_bytes
\n [read files in \/mnt]\n
\nSeverity:<\/strong> 0.0 | NA
\n
\nVisit the link for more details, such as CVSS details, affected products, timeline, and more…<\/p>\n","protected":false},"excerpt":{"rendered":"

CVE ID : CVE-2025-38496 Published : July 28, 2025, 12:15 p.m. | 1\u00a0hour, 5\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: dm-bufio: fix sched in atomic context If “try_verify_in_tasklet” is set for dm-verity, DM_BUFIO_CLIENT_NO_SLEEP is enabled for dm-bufio. However, when bufio tries to evict buffers, there is a chance …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-66891","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/66891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=66891"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/66891\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=66891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=66891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=66891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}