CVE-2025-68373

In the Linux kernel, the following vulnerability has been resolved: md: avoid repeated calls to del_gendisk There is a uaf problem which is found by case 23rdev-lifetime: Oops: general protection fault, probably for non-canonical address 0xdead000000000122 RIP: 0010:bdi_unregister+0x4b/0x170 Call Trace: <TASK> __del_gendisk+0x356/0x3e0 mddev_unlock+0x351/0x360 rdev_attr_store+0x217/0x280 kernfs_fop_write_iter+0x14a/0x210 vfs_write+0x29e/0x550 ksys_write+0x74/0xf0 do_syscall_64+0xbb/0x380 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff5250a177e The sequence is: 1. rdev remove path gets reconfig_mutex 2. rdev remove path release reconfig_mutex in mddev_unlock 3. md stop calls do_md_stop and sets MD_DELETED 4. rdev remove path calls del_gendisk because MD_DELETED is set 5. md stop path release reconfig_mutex and calls del_gendisk again So there is a race condition we should resolve. This patch adds a flag MD_DO_DELETE to avoid the race condition.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/90e3bb44c0a86e245d8e5c6520206fa113acb1ee
https://git.kernel.org/stable/c/b4c5cf406062ad44cd178269571530c6435b2f3b
https://git.kernel.org/stable/c/f0fae1debeb9102398ddf2ef69b4f5d395afafed

Configurations

No configuration.

History

No history.

Information

Published : 2025-12-24 11:16

Updated : 2026-06-17 09:59

NVD link : CVE-2025-68373

Mitre link : CVE-2025-68373

CVE.ORG link : CVE-2025-68373

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2025-68373", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9e59d609763f70a992a8f3808dabcce60f14eb5c", "lessThan": "b4c5cf406062ad44cd178269571530c6435b2f3b", "versionType": "git"}, {"status": "affected", "version": "9e59d609763f70a992a8f3808dabcce60f14eb5c", "lessThan": "f0fae1debeb9102398ddf2ef69b4f5d395afafed", "versionType": "git"}, {"status": "affected", "version": "9e59d609763f70a992a8f3808dabcce60f14eb5c", "lessThan": "90e3bb44c0a86e245d8e5c6520206fa113acb1ee", "versionType": "git"}], "programFiles": ["drivers/md/md.c", "drivers/md/md.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"status": "unaffected", "version": "0", "lessThan": "6.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.17.13", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18.2", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/md/md.c", "drivers/md/md.h"], "defaultStatus": "affected"}]}], "published": "2025-12-24T11:16:00.890", "references": [{"url": "https://git.kernel.org/stable/c/90e3bb44c0a86e245d8e5c6520206fa113acb1ee", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b4c5cf406062ad44cd178269571530c6435b2f3b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f0fae1debeb9102398ddf2ef69b4f5d395afafed", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: avoid repeated calls to del_gendisk\n\nThere is a uaf problem which is found by case 23rdev-lifetime:\n\nOops: general protection fault, probably for non-canonical address 0xdead000000000122\nRIP: 0010:bdi_unregister+0x4b/0x170\nCall Trace:\n <TASK>\n __del_gendisk+0x356/0x3e0\n mddev_unlock+0x351/0x360\n rdev_attr_store+0x217/0x280\n kernfs_fop_write_iter+0x14a/0x210\n vfs_write+0x29e/0x550\n ksys_write+0x74/0xf0\n do_syscall_64+0xbb/0x380\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7ff5250a177e\n\nThe sequence is:\n1. rdev remove path gets reconfig_mutex\n2. rdev remove path release reconfig_mutex in mddev_unlock\n3. md stop calls do_md_stop and sets MD_DELETED\n4. rdev remove path calls del_gendisk because MD_DELETED is set\n5. md stop path release reconfig_mutex and calls del_gendisk again\n\nSo there is a race condition we should resolve. This patch adds a\nflag MD_DO_DELETE to avoid the race condition."}], "lastModified": "2026-06-17T09:59:01.310", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}