CVE-2025-40293

In the Linux kernel, the following vulnerability has been resolved: iommufd: Don't overflow during division for dirty tracking If pgshift is 63 then BITS_PER_TYPE(*bitmap->bitmap) * pgsize will overflow to 0 and this triggers divide by 0. In this case the index should just be 0, so reorganize things to divide by shift and avoid hitting any overflows.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/07105e61882ff4a7d58db63cc5f9e90c6c60506c
https://git.kernel.org/stable/c/4c8a4f1d34eced168cc0b3a3dfe7b6dcc2090f69
https://git.kernel.org/stable/c/cb30dfa75d55eced379a42fd67bd5fb7ec38555e
https://git.kernel.org/stable/c/dbf316fc90aa954dcd5440817f4b944627ed63e0
https://git.kernel.org/stable/c/de7f2c67ceb1941b05b04ac35458a03e93cc57b1

Configurations

No configuration.

History

No history.

Information

Published : 2025-12-08 01:16

Updated : 2026-06-17 09:21

NVD link : CVE-2025-40293

Mitre link : CVE-2025-40293

CVE.ORG link : CVE-2025-40293

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2025-40293", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "58ccf0190d19d9a8a41f8a02b9e06742b58df4a1", "lessThan": "07105e61882ff4a7d58db63cc5f9e90c6c60506c", "versionType": "git"}, {"status": "affected", "version": "58ccf0190d19d9a8a41f8a02b9e06742b58df4a1", "lessThan": "4c8a4f1d34eced168cc0b3a3dfe7b6dcc2090f69", "versionType": "git"}, {"status": "affected", "version": "58ccf0190d19d9a8a41f8a02b9e06742b58df4a1", "lessThan": "de7f2c67ceb1941b05b04ac35458a03e93cc57b1", "versionType": "git"}, {"status": "affected", "version": "58ccf0190d19d9a8a41f8a02b9e06742b58df4a1", "lessThan": "dbf316fc90aa954dcd5440817f4b944627ed63e0", "versionType": "git"}, {"status": "affected", "version": "58ccf0190d19d9a8a41f8a02b9e06742b58df4a1", "lessThan": "cb30dfa75d55eced379a42fd67bd5fb7ec38555e", "versionType": "git"}], "programFiles": ["drivers/iommu/iommufd/iova_bitmap.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"status": "unaffected", "version": "0", "lessThan": "6.1", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.159", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.117", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.58", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.8", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iommu/iommufd/iova_bitmap.c"], "defaultStatus": "affected"}]}], "published": "2025-12-08T01:16:01.293", "references": [{"url": "https://git.kernel.org/stable/c/07105e61882ff4a7d58db63cc5f9e90c6c60506c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4c8a4f1d34eced168cc0b3a3dfe7b6dcc2090f69", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cb30dfa75d55eced379a42fd67bd5fb7ec38555e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dbf316fc90aa954dcd5440817f4b944627ed63e0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/de7f2c67ceb1941b05b04ac35458a03e93cc57b1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Don't overflow during division for dirty tracking\n\nIf pgshift is 63 then BITS_PER_TYPE(*bitmap->bitmap) * pgsize will overflow\nto 0 and this triggers divide by 0.\n\nIn this case the index should just be 0, so reorganize things to divide\nby shift and avoid hitting any overflows."}], "lastModified": "2026-06-17T09:21:36.540", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}