CVE-2025-38072

What it actually does

Division by zero in nd_label_data_init() when config_size (derived from CXL Identify Memory Device LSA size) is zero, causing kernel oops.

Why it matters to the business

Kernel crash on systems using affected CXL memory devices, leading to downtime and potential loss of workloads until reboot or device replacement.

How an attack unfolds

An attacker supplies or emulates a CXL memory device that returns a zero LSA size in response to CXL Command 4000h; the libnvdimm driver stores this zero value, sets max_xfer to zero, and later performs DIV_ROUND_UP() which triggers the divide error during label data initialization.

How to fix it

Update the Linux kernel to a version containing commit 2bd4a938d2eda96ab7288b8fa5aae84a1de8c4ca or later; ensure CXL devices report non-zero LSA sizes.

How to confirm the fix worked

Confirm kernel version includes the fix; test with a CXL device reporting zero LSA size and verify no divide error occurs; review dmesg for absence of nd_label_data_init oops.

Typical attack path

1. Obtain or emulate a CXL device reporting LSA size of zero
2. Attach or present the device to a vulnerable Linux system
3. Trigger nd_label_data_init() via CXL pmem driver initialization
4. Cause kernel divide error and oops

How to detect it

Search kernel logs for 'divide error' combined with 'nd_label_data_init' or CXL pmem initialization failures; inspect dmesg and syslog for Oops involving libnvdimm.

• divide error: 0000 [#1] PREEMPT SMP NOPTI
• RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm]
• Oops.*libnvdimm

What your security team should do

• Prioritize kernel updates on systems with CXL memory devices
• Monitor for kernel oops involving libnvdimm
• Validate CXL device firmware and reported LSA sizes