CVE-2025-21874

dm-integrity: Avoid divide by zero in table status in Inline mode

Description

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: Avoid divide by zero in table status in Inline mode In Inline mode, the journal is unused, and journal_sectors is zero. Calculating the journal watermark requires dividing by journal_sectors, which should be done only if the journal is configured. Otherwise, a simple table query (dmsetup table) can cause OOPS. This bug did not show on some systems, perhaps only due to compiler optimization. On my 32-bit testing machine, this reliably crashes with the following: : Oops: divide error: 0000 [#1] PREEMPT SMP : CPU: 0 UID: 0 PID: 2450 Comm: dmsetup Not tainted 6.14.0-rc2+ #959 : EIP: dm_integrity_status+0x2f8/0xab0 [dm_integrity] ...

N/A

CVSS

Severity:

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/22c6f577b3cb184857b440ae5e5916f6c9e7021d
https://git.kernel.org/stable/c/06d9895f265282e939a8933bb18de82eba2b4dda
https://git.kernel.org/stable/c/7fb39882b20c98a9a393c244c86b56ef6933cff8

Frequently Asked Questions

What is the severity of CVE-2025-21874?: CVE-2025-21874 has not yet been assigned a CVSS score.
How to fix CVE-2025-21874?: To fix CVE-2025-21874, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-21874 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-21874 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-21874?: CVE-2025-21874 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.