CVE-2025-22126: md: fix mddev uaf while iterating all_mddevs list
In the Linux kernel, the following vulnerability has been resolved:
md: fix mddev uaf while iterating allmddevs list
While iterating allmddevs list from mdnotifyreboot() and mdexit(), listforeachentrysafe is used, and this can race with deletint the next mddev, causing UAF:
t1: spinlock //listforeachentrysafe(mddev, n, ...) mddevget(mddev1) // assume mddev2 is the next entry spinunlock t2: //remove mddev2 ... mddevfree spinlock listdel spinunlock kfree(mddev2) mddevput(mddev1) spinlock //continue dereference mddev2->allmddevs
The old helper foreachmddev() actually grab the reference of mddev2 while holding the lock, to prevent from being freed. This problem can be fixed the same way, however, the code will be complex.
Hence switch to use listforeachentry, in this case mddevput() can free the mddev1 and it's not safe as well. Refer to mdseqshow(), also factor out a helper mddevputlocked() to fix this problem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22126?
CVE-2025-22126 has a severity rating that indicates a potential for privilege escalation due to use-after-free vulnerabilities in the Linux kernel.
How do I fix CVE-2025-22126?
To fix CVE-2025-22126, ensure that your Linux kernel is updated to a version that includes the necessary patches provided for this vulnerability.
Which systems are affected by CVE-2025-22126?
CVE-2025-22126 affects systems running vulnerable versions of the Linux kernel.
What can exploit CVE-2025-22126?
CVE-2025-22126 can potentially be exploited by local attackers who have the ability to run code on the affected systems.
Is CVE-2025-22126 included in any security advisories?
Yes, CVE-2025-22126 is included in various security advisories detailing the vulnerability and remediation steps.