CVE-2025-38255 lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()

Medium 5.5 Published 9 Jul 2025 Updated 11 May 2026

A local attacker can trigger a kernel panic via null_blk configfs, causing denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-38255?

CVE-2025-38255 is a medium-severity vulnerability in Linux kernel, published on 9 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()

While testing null_blk with configfs, echo 0 > poll_queues will trigger following panic:

BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 27 UID: 0 PID: 920 Comm: bash Not tainted 6.15.0-02023-gadbdb95c8696-dirty #1238 PREEMPT(undef) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:__bitmap_or+0x48/0x70 Call Trace: <TASK> __group_cpus_evenly+0x822/0x8c0 group_cpus_evenly+0x2d9/0x490 blk_mq_map_queues+0x1e/0x110 null_map_queues+0xc9/0x170 [null_blk] blk_mq_update_queue_map+0xdb/0x160 blk_mq_update_nr_hw_queues+0x22b/0x560 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_poll_queues_store+0xa4/0x130 [null_blk] configfs_write_iter+0x109/0x1d0 vfs_write+0x26e/0x6f0 ksys_write+0x79/0x180 __x64_sys_write+0x1d/0x30 x64_sys_call+0x45c4/0x45f0 do_syscall_64+0xa5/0x240 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Root cause is that numgrps is set to 0, and ZERO_SIZE_PTR is returned from kcalloc(), and later ZERO_SIZE_PTR will be deferenced.

Fix the problem by checking numgrps first in group_cpus_evenly(), and return NULL directly if numgrps is zero.

[[email protected]: also fix the non-SMP version]

Weakness: CWE-476

Which versions are affected by CVE-2025-38255?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2025-38255?

Apply the vendor's patch.

Is CVE-2025-38255 being exploited?

There is no known exploitation of CVE-2025-38255 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as BELL-CVE-2025-38255, DEBIAN-CVE-2025-38255, GHSA-3574-q5g6-f77j, ROOT-OS-UBUNTU-2404-CVE-2025-38255, UBUNTU-CVE-2025-38255.