Integer Division Overflow in Linux Kernel Affecting Device Drivers

CVE-2025-40293

What is CVE-2025-40293?

A vulnerability has been identified in the Linux kernel related to integer division overflow during dirty tracking in device drivers. Specifically, when the page shift parameter (pgshift) is set to 63, the computation involving BITS_PER_TYPE(*) can overflow, resulting in an incorrect division by 0. This flaw can potentially cause disruptions in system operations, as it produces incorrect indexing of memory. The kernel developers have reorganized the mathematical approach to prevent overflow by dividing by shift rather than directly computing the overflow-prone formula. Users are advised to apply the latest security patches to mitigate this issue.

References