CVE-2025-39791

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm: dm-crypt: Do not partially accept write BIOs with zoned targets

Read and write operations issued to a dm-crypt target may be split

according to the dm-crypt internal limits defined by the max_read_size

and max_write_size module parameters (default is 128 KB). The intent is

to improve processing time of large BIOs by splitting them into smaller

operations that can be parallelized on different CPUs.

For zoned dm-crypt targets, this BIO splitting is still done but without

the parallel execution to ensure that the issuing order of write

operations to the underlying devices remains sequential. However, the

splitting itself causes other problems:

1) Since dm-crypt relies on the block layer zone write plugging to

handle zone append emulation using regular write operations, the

reminder of a split write BIO will always be plugged into the target

zone write plugged. Once the on-going write BIO finishes, this

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References