CVE-2025-22124: md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
In the Linux kernel, the following vulnerability has been resolved:
md/md-bitmap: fix wrong bitmaplimit for clustermd when write sb
In clustermd, separate write-intent-bitmaps are used for each cluster node:
0 4k 8k 12k ------------------------------------------------------------------- | idle | md super | bm super [0] + bits | | bm bits[0, contd] | bm super[1] + bits | bm bits[1, contd] | | bm super[2] + bits | bm bits [2, contd] | bm super[3] + bits | | bm bits [3, contd] | | |
So in node 1, pgindex in writesbpage() could equal to bitmap->storage.filepages. Then bitmaplimit will be calculated to 0. mdsuperwrite() will be called with 0 size. That means the first 4k sb area of node 1 will never be updated through filemapwritepage(). This bug causes hang of mdadm/clustermdtests/01r1Growresize.
Here use (pgindex % bitmap->storage.filepages) to make calculation of bitmaplimit correct.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel md/clustermd bitmap code, calculate bitmap_limit using (pg_index % bitmap->storage.file_pages) so the node 1 superblock area is updated correctly and md_super_write() is not called with a zero size.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22124?
CVE-2025-22124 is considered a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-22124?
To fix CVE-2025-22124, you should update to the latest version of the Linux kernel that includes the vulnerability resolution.
What type of vulnerability is CVE-2025-22124?
CVE-2025-22124 is a vulnerability related to incorrect handling of bitmap limits in the clustermd functionality of the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2025-22124?
CVE-2025-22124 affects certain versions of the Linux kernel prior to the fix implemented in the patch.
What impact does CVE-2025-22124 have on systems?
CVE-2025-22124 can potentially lead to data corruption and unstable behavior in systems using clustermd with incorrect bitmap handling.