CVE-2025-23131
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel's DLM (Distributed Lock Manager), a vulnerability leads to a NULL pointer dereference (NPD). When a positive value is written to the event_done file, the new_lockspace function undoes all work, leaving lockspace uninitialized. The __dlm_new_lockspace function incorrectly treats this positive value as success, passing a NULL pointer to dlm_find_lockspace_local, causing a crash.
Risk Assessment
A local attacker can trigger a kernel panic by writing a positive value to event_done, causing a denial of service (DoS) and system instability.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit 8511a2728ab8 or later). If an update is not possible, restrict access to the event_done interface to trusted users only.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: dlm: prevent NPD when writing a positive value to event_done do_uevent returns the value written to event_done. In case it is a positive value, new_lockspace would undo all the work, and lockspace would not be set. __dlm_new_lockspace, however, would treat that positive value as a success due to commit 8511a2728ab8 ("dlm: fix use count with multiple joins"). Down the line, device_create_lockspace would pass that NULL lockspace to dlm_find_lockspace_local, leading to a NULL pointer dereference. Treating such positive values as successes prevents the problem. Given this has been broken for so long, this is unlikely to break userspace expectations.