Linux Kernel Vulnerability in Throttle Policy Activation

CVE-2025-40147

What is CVE-2025-40147?

A vulnerability in the Linux kernel arises during throttle policy activation in the blk-throttle component. This issue can cause a NULL pointer dereference when throttling is checked before the throttle policy is fully initialized, leading to potential crashes. The failure occurs when critical state data is not yet attached to block groups, resulting in the kernel attempting to dereference a NULL value and causing stability issues following cold boots.

References