CVE-2025-68368: md: init bioset in mddev_init
In the Linux kernel, the following vulnerability has been resolved:
md: init bioset in mddevinit
IO operations may be needed before mdrun(), such as updating metadata after writing sysfs. Without bioset, this triggers a NULL pointer dereference as below:
BUG: kernel NULL pointer dereference, address: 0000000000000020 Call Trace: mdupdatesb+0x658/0xe00 newlevelstore+0xc5/0x120 mdattrstore+0xc9/0x1e0 sysfskfwrite+0x6f/0xa0 kernfsfopwriteiter+0x141/0x2a0 vfswrite+0x1fc/0x5a0 ksyswrite+0x79/0x180 x64syswrite+0x1d/0x30 x64syscall+0x2818/0x2880 dosyscall64+0xa9/0x580 entrySYSCALL64afterhwframe+0x4b/0x53
Reproducer mdadm -CR /dev/md0 -l1 -n2 /dev/sd[cd] echo inactive > /sys/block/md0/md/arraystate echo 10 > /sys/block/md0/md/newlevel
mddevinit() can only be called once per mddev, no need to test if bioset has been initialized anymore.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68368?
CVE-2025-68368 has a high severity due to the potential for a NULL pointer dereference leading to system instability.
How do I fix CVE-2025-68368?
To fix CVE-2025-68368, update your Linux kernel to the latest version where this vulnerability has been patched.
What systems are affected by CVE-2025-68368?
CVE-2025-68368 affects multiple versions of the Linux kernel.
What type of vulnerability is CVE-2025-68368?
CVE-2025-68368 is a memory management vulnerability related to kernel operations.
Can CVE-2025-68368 be exploited remotely?
CVE-2025-68368 may be exploited locally, thus affecting system reliability rather than allowing remote attacks.