LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21874: dm-integrity: Avoid divide by zero in table status in Inline mode

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: Avoid divide by zero in table status in Inline mode In Inline mode, the journal is unused, and journal_sectors is zero. Calculating the journal watermark requires dividing by journal_sectors, which should be done only if the journal is configured. Otherwise, a simple table query (dmsetup table) can cause OOPS. This bug did not show on some systems, perhaps only due to compiler optimization. On my 32-bit testing machine, this reliably crashes with the following: : Oops: divide error: 0000 [#1] PREEMPT SMP : CPU: 0 UID: 0 PID: 2450 Comm: dmsetup Not tainted 6.14.0-rc2+ #959 : EIP: dm_integrity_status+0x2f8/0xab0 [dm_integrity] ...

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-21874 is a Linux kernel crash bug in dm-integrity. On systems using dm-integrity Inline mode, a normal table query can trigger a divide-by-zero kernel OOPS because the journal size is zero. The impact is availability, not data theft, based on the supplied sources.

Executive priority

Treat as a targeted availability risk for Linux storage stacks using dm-integrity Inline mode. Patch during the next kernel maintenance cycle, sooner for systems where local administrators or automation can query device-mapper tables.

Technical view

In dm-integrity Inline mode, the journal is unused and journal_sectors is zero. The status handler calculated a journal watermark without first confirming a journal existed, so a table status query such as dmsetup table could reach a divide-by-zero path and crash affected kernels.

Likely exposure

Exposure appears limited to Linux systems using the dm-integrity device-mapper target in Inline mode on affected kernel versions. General Linux hosts without this configuration are not shown as affected by the supplied sources. Distribution exposure depends on vendor kernel backports.

Exploitation context

The sources describe a local table query causing a kernel OOPS. They do not show remote exploitation, privilege boundaries, public exploit code, CVSS scoring, or CISA KEV listing. Active exploitation should not be assumed from this bundle.

Researcher notes

The key condition is journal_sectors being zero in Inline mode while status reporting performs a journal watermark calculation. The fix direction is guarding that calculation when no journal is configured. The bundle does not provide CVSS, CWE, exploit maturity, or distro package status.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Check Linux distribution advisories for backported dm-integrity patches.
  • Limit dmsetup access to trusted administrators where feasible.
  • Prioritize systems using dm-integrity Inline mode.
  • Monitor vendor guidance for exact fixed package versions.

Validation and detection

  • Inventory hosts using the dm-integrity target.
  • Identify whether dm-integrity Inline mode is configured.
  • Compare running kernel versions against vendor fixed builds.
  • Confirm the relevant stable commits are included or backported.
  • Review logs for kernel OOPS events involving dm_integrity_status.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21874 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfb0987682c629c1d2c476f35f6fde405a5e304a4, fb0987682c629c1d2c476f35f6fde405a5e304a4, fb0987682c629c1d2c476f35f6fde405a5e304a4unaffected
LinuxLinux6.11, 0, 6.12.18, 6.13.6, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.