CVE-2025-71225: md: suspend array while updating raid_disks via sysfs

Published Feb 18, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

md: suspend array while updating raiddisks via sysfs

In raid1reshape(), freezearray() is called before modifying the r1bio memory pool (conf->r1biopool) and conf->raiddisks, and unfreezearray() is called after the update is completed.

However, freezearray() only waits until nrsyncpending and (nrpending - nrqueued) of all buckets reaches zero. When an I/O error occurs, nrqueued is increased and the corresponding r1bio is queued to either retrylist or bioendiolist. As a result, freezearray() may unblock before these r1bios are released.

This can lead to a situation where conf->raiddisks and the mempool have already been updated while queued r1bios, allocated with the old raiddisks value, are later released. Consequently, freer1bio() may access memory out of bounds in putallbios() and release r1bios of the wrong size to the new mempool, potentially causing issues with the mempool as well.

Since only normal I/O might increase nrqueued while an I/O error occurs, suspending the array avoids this issue.

Note: Updating raiddisks via ioctl SETARRAYINFO already suspends the array. Therefore, we suspend the array when updating raiddisks via sysfs to avoid this issue too.

Affected Software

11 affected components
Linux Linux kernel
Linux Linux kernel>=3.4.59<3.5
Linux Linux kernel>=3.9.7<3.10
Linux Linux kernel>=3.10.1<6.12.70
Linux Linux kernel>=6.13<6.18.10
Linux Linux kernel=3.10
Linux Linux kernel=3.10-rc6
Linux Linux kernel=3.10-rc7
Linux Linux kernel=6.19-rc1
Linux Linux kernel=6.19-rc2
Linux Linux kernel=6.19-rc3

Event History

Feb 18, 2026
CVE Published
via MITRE·02:21 PM
Data Sourced
via MITRE·02:21 PM
Description
Data Sourced
via NVD·03:18 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-71225?

CVE-2025-71225 is considered to have a medium severity due to its potential impact on data integrity during RAID array updates.

2

How do I fix CVE-2025-71225?

To fix CVE-2025-71225, you should update the Linux kernel to the latest version where the vulnerability has been patched.

3

What systems are affected by CVE-2025-71225?

CVE-2025-71225 affects Linux systems that utilize the md subsystem for RAID configuration.

4

What are the potential risks of CVE-2025-71225?

The potential risks of CVE-2025-71225 include data corruption or loss during updates to RAID disks.

5

Is there a known exploit for CVE-2025-71225?

As of now, there are no publicly known exploits specifically targeting CVE-2025-71225.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203