{"id":"CVE-2025-38072","title":"libnvdimm/labels: Fix divide error in nd_label_data_init()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibnvdimm/labels: Fix divide error in nd_label_data_init()\n\nIf a faulty CXL memory device returns a broken zero LSA size in its\nmemory device information (Identify Memo…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < 2bd4a938d2eda96ab7288b8fa5aae84a1de8c4ca","Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < 396c46d3f59a18ebcc500640e749f16e197d472b","Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < f49c337037df029440a8390380dd35d2cf5924d3","Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < db1aef51b8e66a77f76b1250b914589c31a0a0ed","Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < ea3d95e05e97ea20fd6513f647393add16fce3b2","Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < 1d1e1efad1cf049e888bf175a5c6be85d792620c","Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < e14347f647ca6d76fe1509b6703e340f2d5e2716","Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < ef1d3455bbc1922f94a91ed58d3d7db440652959","Linux 4.20"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:49:14.375753Z"},"published":"2025-06-18","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:52:14.942Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38072","references":[{"url":"https://git.kernel.org/stable/c/2bd4a938d2eda96ab7288b8fa5aae84a1de8c4ca"},{"url":"https://git.kernel.org/stable/c/396c46d3f59a18ebcc500640e749f16e197d472b"},{"url":"https://git.kernel.org/stable/c/f49c337037df029440a8390380dd35d2cf5924d3"},{"url":"https://git.kernel.org/stable/c/db1aef51b8e66a77f76b1250b914589c31a0a0ed"},{"url":"https://git.kernel.org/stable/c/ea3d95e05e97ea20fd6513f647393add16fce3b2"},{"url":"https://git.kernel.org/stable/c/1d1e1efad1cf049e888bf175a5c6be85d792620c"},{"url":"https://git.kernel.org/stable/c/e14347f647ca6d76fe1509b6703e340f2d5e2716"},{"url":"https://git.kernel.org/stable/c/ef1d3455bbc1922f94a91ed58d3d7db440652959"}],"tags":["cve.org"],"epss":0.00222,"epssPercentile":0.12804,"ingestedAt":"2026-11-05T22:38:31.917Z","slug":"CVE-2025-38072","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibnvdimm/labels: Fix divide error in nd_label_data_init()\n\nIf a faulty CXL memory device returns a broken zero LSA size in its\nmemory device information (Identify Memory Device (Opcode 4000h), CXL\nspec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm\ndriver:\n\n Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI\n RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm]\n\nCode and flow:\n\n1) CXL Command 4000h returns LSA size = 0\n2) config_size is assigned to zero LSA size (CXL pmem driver):\n\ndrivers/cxl/pmem.c:             .config_size = mds->lsa_size,\n\n3) max_xfer is set to zero (nvdimm driver):\n\ndrivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size);\n\n4) A subsequent DIV_ROUND_UP() causes a division by zero:\n\ndrivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */\ndrivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer,\ndrivers/nvdimm/label.c-                 config_size);\n\nFix this by checking the config size parameter by extending an\nexisting check.\n\n## Affected\n\n- `Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < 2bd4a938d2eda96ab7288b8fa5aae84a1de8c4ca`\n- `Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < 396c46d3f59a18ebcc500640e749f16e197d472b`\n- `Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < f49c337037df029440a8390380dd35d2cf5924d3`\n- `Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < db1aef51b8e66a77f76b1250b914589c31a0a0ed`\n- `Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < ea3d95e05e97ea20fd6513f647393add16fce3b2`\n- `Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < 1d1e1efad1cf049e888bf175a5c6be85d792620c`\n- `Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < e14347f647ca6d76fe1509b6703e340f2d5e2716`\n- `Linux >= 7d47aad4570e5e6e9a8162bb417ca9b74132f27c < ef1d3455bbc1922f94a91ed58d3d7db440652959`\n- `Linux 4.20`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}