CVE-2025-38445
published 2025-07-25CVE-2025-38445: In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix stack memory use after return in raid1_reshape In the raid1_reshape function…
high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
In the Linux kernel, the following vulnerability has been resolved:
md/raid1: Fix stack memory use after return in raid1_reshape
In the raid1_reshape function, newpool is
allocated on the stack and assigned to conf->r1bio_pool.
This results in conf->r1bio_pool.wait.head pointing
to a stack address.
Accessing this address later can lead to a kernel panic.
Example access path:
raid1_reshape()
{
// newpool is on the stack
mempool_t newpool, oldpool;
// initialize newpool.wait.head to stack address
mempool_init(&newpool, ...);
conf->r1bio_pool = newpool;
}
raid1_read_request() or raid1_write_request()
{
alloc_r1bio()
{
mempool_alloc()
{
// if pool->alloc fails
remove_element()
{
--pool->curr_nr;
}
}
}
}
mempool_free()
{
if (pool->curr_nr min_nr) {
// pool->wait.head is a stack address
// wake_up() will try to access this invalid address
// which leads to a kernel panic
return;
wake_up(&pool->wait);
}
}
Fix:
reinit conf->r1bio_pool.wait after assigning newpool.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < d8a6853d00fbaa810765c8ed2f452a5832273968 | d8a6853d00fbaa810765c8ed2f452a5832273968 |
| linux | linux | >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < 12b00ec99624f8da8c325f2dd6e807df26df0025 | 12b00ec99624f8da8c325f2dd6e807df26df0025 |
| linux | linux | >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < 48da050b4f54ed639b66278d0ae6f4107b2c4e2d | 48da050b4f54ed639b66278d0ae6f4107b2c4e2d |
| linux | linux | >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < 5f35e48b76655e45522df338876dfef88dafcc71 | 5f35e48b76655e45522df338876dfef88dafcc71 |
| linux | linux | >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < df5894014a92ff0196dbc212a7764e97366fd2b7 | df5894014a92ff0196dbc212a7764e97366fd2b7 |
| linux | linux | >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < 776e6186dc9ecbdb8a1b706e989166c8a99bbf64 | 776e6186dc9ecbdb8a1b706e989166c8a99bbf64 |
| linux | linux | >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < 61fd5e93006cf82ec8ee5c115ab5cf4bbd104bdb | 61fd5e93006cf82ec8ee5c115ab5cf4bbd104bdb |
| linux | linux | >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98 | d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.244-1 | 5.10.244-1 |
| linux | linux_kernel | >= 0 < 6.1.147-1 | 6.1.147-1 |
| linux | linux_kernel | >= 0 < 6.12.41-1 | 6.12.41-1 |
| linux | linux_kernel | >= 0 < 6.16.3-1 | 6.16.3-1 |
| linux | linux_kernel | >= 0 < 5.15.0-156.166 | 5.15.0-156.166 |
| linux | linux_kernel | >= 0 < 6.8.0-100.100 | 6.8.0-100.100 |
| linux | linux_kernel | >= 4.18 < 5.4.296 | 5.4.296 |
| linux | linux_kernel | >= 5.11 < 5.15.189 | 5.15.189 |
| linux | linux_kernel | >= 5.16 < 6.1.146 | 6.1.146 |
| linux | linux_kernel | >= 5.5 < 5.10.240 | 5.10.240 |
| linux | linux_kernel | >= 6.13 < 6.15.7 | 6.15.7 |
| linux | linux_kernel | >= 6.2 < 6.6.99 | 6.6.99 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH