CVE-2025-38621: md: make rdev_addable usable for rcu mode
In the Linux kernel, the following vulnerability has been resolved:
md: make rdevaddable usable for rcu mode
Our testcase trigger panic:
BUG: kernel NULL pointer dereference, address: 00000000000000e0 ... Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 85 Comm: kworker/2:1 Not tainted 6.16.0+ #94 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Workqueue: mdmisc mdstartsync RIP: 0010:rdevaddable+0x4d/0xf0 ... Call Trace: <TASK> mdstartsync+0x329/0x480 processonework+0x226/0x6d0 workerthread+0x19e/0x340 kthread+0x10f/0x250 retfromfork+0x14d/0x180 retfromforkasm+0x1a/0x30 </TASK> Modules linked in: raid10 CR2: 00000000000000e0 ---[ end trace 0000000000000000 ]--- RIP: 0010:rdevaddable+0x4d/0xf0
mdsparesneedchange in mdstartsync will call rdevaddable which protected by rcureadlock/rcureadunlock. This rcu context will help protect rdev won't be released, but rdev->mddev will be set to NULL before we call synchronizercu in mdkickrdevfromarray. Fix this by using READONCE and check does rdev->mddev still alive.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.16.3-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.109 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.16.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.115-2~deb12u1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38621?
CVE-2025-38621 is classified as a high-severity vulnerability due to its potential to cause kernel panics.
How do I fix CVE-2025-38621?
To fix CVE-2025-38621, you should upgrade the Linux kernel to a version that has patched this vulnerability, starting from version 6.16.1.
What versions of the Linux kernel are affected by CVE-2025-38621?
CVE-2025-38621 affects Linux kernel versions prior to 6.16.1.
What type of attack can exploit CVE-2025-38621?
CVE-2025-38621 can be exploited by local attackers to trigger a kernel NULL pointer dereference, leading to denial of service.
Is there a workaround for CVE-2025-38621 until I can apply a patch?
No formal workaround exists for CVE-2025-38621, so the recommendation is to apply the patch as soon as possible.