Linux Kernel Vulnerability in AOE Device Handling

CVE-2025-38326

What is CVE-2025-38326?

A vulnerability in the Linux kernel related to the handling of AOE device requests has been identified. When an AOE device is taken offline, the rq_list, which contains accepted block requests awaiting transmission, was not properly cleared. This oversight leads to a scenario where the blk_mq_freeze_queue() function may block indefinitely, resulting in a system hang due to unprocessed requests. The implemented fix ensures that the request queue is cleaned before the freezing operation is executed, thus preventing potential system hangs.

References