CVE-2025-38066

一、漏洞信息
 漏洞编号：[CVE-2025-38066](https://nvd.nist.gov/vuln/detail/CVE-2025-38066)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:dm cache: prevent BUG_ON by blocking retries on failed device resumesA cache device failing to resume due to mapping errors should not beretried, as the failure leaves a partially initialized policy object.Repeating the resume operation risks triggering BUG_ON when reloadingcache mappings into the incomplete policy object.Reproduce steps:1. create a cache metadata consisting of 512 or more cache blocks,   with some mappings stored in the first array block of the mapping   array. Here we use cache_restore v1.0 to build the metadata.cat <<EOF >> cmeta.xml<superblock uuid=   block_size= 128  nr_cache_blocks= 512   policy= smq  hint_width= 4 >  <mappings>    <mapping cache_block= 0  origin_block= 0  dirty= false />  </mappings></superblock>EOFdmsetup create cmeta --table  0 8192 linear /dev/sdc 0 cache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2dmsetup remove cmeta2. wipe the second array block of the mapping array to simulate   data degradations.mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192  2>/dev/null | hexdump -e  1/8  %u n  )ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056))  2>/dev/null | hexdump -e  1/8  %u n  )dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock3. try bringing up the cache device. The resume is expected to fail   due to the broken array block.dmsetup create cmeta --table  0 8192 linear /dev/sdc 0 dmsetup create cdata --table  0 65536 linear /dev/sdc 8192 dmsetup create corig --table  0 524288 linear /dev/sdc 262144 dmsetup create cache --notabledmsetup load cache --table  0 524288 cache /dev/mapper/cmeta  /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0 dmsetup resume cache4. try resuming the cache again. An unexpected BUG_ON is triggered   while loading cache mappings.dmsetup resume cacheKernel logs:(snip)------------[ cut here ]------------kernel BUG at drivers/md/dm-cache-policy-smq.c:752!Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTICPU: 0 UID: 0 PID: 332 Comm: dmsetup Not tainted 6.13.4 #3RIP: 0010:smq_load_mapping+0x3e5/0x570Fix by disallowing resume operations for devices that failed theinitial attempt.
 漏洞公开时间：2025-06-18 18:15:39
 漏洞创建时间：2025-06-18 18:26:00
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-38066
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  |
|  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  |
|  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  |
|  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  |
|  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  |
|  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  |
|  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  |
|  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  |
|  | https://security-tracker.debian.org/tracker/CVE-2025-38066 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2373348 |  |
|  | https://access.redhat.com/security/cve/CVE-2025-38066 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38066 |  |
|  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  |
|  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  |
|  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  |
|  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  |
|  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  |
|  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  |
|  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  |
|  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38066 |  |
|  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  |
|  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  |
|  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  |
|  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  |
|  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  |
|  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  |
|  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  |
|  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38066 |  |
|  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  |
|  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  |
|  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  |
|  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  |
|  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  |
|  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  |
|  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  |
|  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38066 |  |
|  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  |
|  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  |
|  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  |
|  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  |
|  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  |
|  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  |
|  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  |
|  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38066 |  |
|  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  |
|  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  |
|  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  |
|  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  |
|  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  |
|  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  |
|  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  |
|  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38066 |  |
|  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  |
|  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  |
|  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  |
|  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  |
|  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  |
|  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  |
|  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  |
|  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38066 |  |
|  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  |
|  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  |
|  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  |
|  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  |
|  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  |
|  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  |
|  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  |
|  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38066 |  |
|  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  |
|  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  |
|  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  |
|  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  |
|  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  |
|  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  |
|  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  |
|  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  |
|  | https://linux.oracle.com/cve/CVE-2025-38066.html |  |
|  | https://linux.oracle.com/errata/ELSA-2025-20480.html |  |
|  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  |
|  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  |
|  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  |
|  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  |
|  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  |
|  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  |
|  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  |
|  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  |
|  | https://linux.oracle.com/cve/CVE-2025-38066.html |  |
|  | https://linux.oracle.com/errata/ELSA-2025-20480.html |  |
|  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  |
|  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  |
|  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  |
|  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  |
|  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://github.com/gregkh/linux/commit/5da692e2262b8f81993baa9592f57d12c2703dea.patch |  | ljqc |
|  |  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  | nvd |
|  |  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  | nvd |
|  |  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  | nvd |
|  |  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  | nvd |
|  |  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  | nvd |
|  |  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  | nvd |
|  |  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  | nvd |
|  |  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  | nvd |
|  |  | https://git.kernel.org/stable/c/00586b78eeb7c626a14ca13453a1631f88a7cf36 |  | snyk |
|  |  | https://git.kernel.org/stable/c/025c8f477625eb39006ded650e7d027bcfb20e79 |  | snyk |
|  |  | https://git.kernel.org/stable/c/3986ef4a9b6a0d9c28bc325d8713beba5e67586f |  | snyk |
|  |  | https://git.kernel.org/stable/c/5da692e2262b8f81993baa9592f57d12c2703dea |  | snyk |
|  |  | https://git.kernel.org/stable/c/c5356a5e80442131e2714d0d26bb110590e4e568 |  | snyk |
|  |  | https://git.kernel.org/stable/c/c614584c2a66b538f469089ac089457a34590c14 |  | snyk |
|  |  | https://git.kernel.org/stable/c/cc80a5cc520939d0a7d071cc4ae4b3c55ef171d0 |  | snyk |
|  |  | https://git.kernel.org/stable/c/f3128e3074e8af565cc6a66fe3384a56df87f803 |  | snyk |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:dm cache: prevent BUG_ON by blocking retries on failed device resumesA cache device failing to resume due to mapping errors should not beretried, as the failure leaves a partially initialized policy object.Repeating the resume operation risks triggering BUG_ON when reloadingcache mappings into the incomplete policy object.Reproduce steps:1. create a cache metadata consisting of 512 or more cache blocks,   with some mappings stored in the first array block of the mapping   array. Here we use cache_restore v1.0 to build the metadata.cat &lt;&lt;EOF &gt;&gt; cmeta.xml&lt;superblock uuid=&#34;&#34; block_size=&#34;128&#34; nr_cache_blocks=&#34;512&#34;  policy=&#34;smq&#34; hint_width=&#34;4&#34;&gt;  &lt;mappings&gt;    &lt;mapping cache_block=&#34;0&#34; origin_block=&#34;0&#34; dirty=&#34;false&#34;/&gt;  &lt;/mappings&gt;&lt;/superblock&gt;EOFdmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34;cache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2dmsetup remove cmeta2. wipe the second array block of the mapping array to simulate   data degradations.mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192  2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u n&#34;&#39;)ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056))  2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u n&#34;&#39;)dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock3. try bringing up the cache device. The resume is expected to fail   due to the broken array block.dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34;dmsetup create cdata --table &#34;0 65536 linear /dev/sdc 8192&#34;dmsetup create corig --table &#34;0 524288 linear /dev/sdc 262144&#34;dmsetup create cache --notabledmsetup load cache --table &#34;0 524288 cache /dev/mapper/cmeta  /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0&#34;dmsetup resume cache4. try resuming the cache again. An unexpected BUG_ON is triggered   while loading cache mappings.dmsetup resume cacheKernel logs:(snip)------------[ cut here ]------------kernel BUG at drivers/md/dm-cache-policy-smq.c:752!Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTICPU: 0 UID: 0 PID: 332 Comm: dmsetup Not tainted 6.13.4 #3RIP: 0010:smq_load_mapping+0x3e5/0x570Fix by disallowing resume operations for devices that failed theinitial attempt.The Linux kernel CVE team has assigned CVE-2025-38066 to this issue.
 openEuler评分：
  4.1
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.openEuler-24.03-LTS-SP2(6.6.0):受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
5.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
6.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
7.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2122

src-openEuler/kernel

内容风险标识

评论 (7)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-38066

评论 (7)

搜索帮助

src-openEuler/kernel