In the Linux kernel, the following vulnerability has been resolved:
md: fix a crash in mempool_free
There's a crash in mempool_free when running the lvm test shell/lvchange-rebuild-raid.sh.
The reason for the crash is this: * super_written calls atomic_dec_and_test(&mddev->pending_writes) and wake_up(&mddev->sb_wait). Then it calls rdev_dec_pending(rdev, mddev) and bio_put(bio). * so, the process that waited on sb_wait and that is woken up is racing with bio_put(bio). * if the process wins the race, it calls bioset_exit before bio_put(bio) is executed. * bio_put(bio) attempts to free a bio into a destroyed bio set - causing a crash in mempool_free.
We fix this bug by moving bio_put before atomic_dec_and_test.
We also move rdev_dec_pending before atomic_dec_and_test as suggested by Neil Brown.
The function md_end_flush has a similar bug - we must call bio_put before we decrement the number of in-progress bios.
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 11557f0067 P4D 11557f0067 PUD 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 73 Comm: kworker/0:1 Not tainted 6.1.0-rc3 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Workqueue: kdelayd flush_expired_bios [dm_delay] RIP: 0010:mempool_free+0x47/0x80 Code: 48 89 ef 5b 5d ff e0 f3 c3 48 89 f7 e8 32 45 3f 00 48 63 53 08 48 89 c6 3b 53 04 7d 2d 48 8b 43 10 8d 4a 01 48 89 df 89 4b 08 <48> 89 2c d0 e8 b0 45 3f 00 48 8d 7b 30 5b 5d 31 c9 ba 01 00 00 00 RSP: 0018:ffff88910036bda8 EFLAGS: 00010093 RAX: 0000000000000000 RBX: ffff8891037b65d8 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000202 RDI: ffff8891037b65d8 RBP: ffff8891447ba240 R08: 0000000000012908 R09: 00000000003d0900 R10: 0000000000000000 R11: 0000000000173544 R12: ffff889101a14000 R13: ffff8891562ac300 R14: ffff889102b41440 R15: ffffe8ffffa00d05 FS: 0000000000000000(0000) GS:ffff88942fa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000001102e99000 CR4: 00000000000006b0 Call Trace: <TASK> clone_endio+0xf4/0x1c0 [dm_mod] clone_endio+0xf4/0x1c0 [dm_mod] __submit_bio+0x76/0x120 submit_bio_noacct_nocheck+0xb6/0x2a0 flush_expired_bios+0x28/0x2f [dm_delay] process_one_work+0x1b4/0x300 worker_thread+0x45/0x3e0 ? rescuer_thread+0x380/0x380 kthread+0xc2/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Modules linked in: brd dm_delay dm_raid dm_mod af_packet uvesafb cfbfillrect cfbimgblt cn cfbcopyarea fb font fbdev tun autofs4 binfmt_misc configfs ipv6 virtio_rng virtio_balloon rng_core virtio_net pcspkr net_failover failover qemu_fw_cfg button mousedev raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 md_mod sd_mod t10_pi crc64_rocksoft crc64 virtio_scsi scsi_mod evdev psmouse bsg scsi_common [last unloaded: brd] CR2: 0000000000000000 ---[ end trace 0000000000000000 ]---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-4.14.304-226.531Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernelUpgrade bpftoolUpgrade kernel-livepatch-5.15.90-54.138Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.165-143.735Upgrade kernel-develUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade python-perfUpgrade perf-debuginfoUpgrade perfUpgrade kernel-tools-devel | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Sep 22, 2025 | Sep 22, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelists | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade bpftool | Feb 3, 2026 | Jan 30, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 18, 2025 |
| Ubuntu | — | Upgrade linux-aws-5.4Upgrade linux-hwe-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linuxUpgrade linux-bluefieldUpgrade linux-gkeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-raspi-5.4Upgrade linux-aws-hweUpgrade linux-intel-iotgUpgrade linux-lowlatencyUpgrade linux-realtimeUpgrade linux-aws-5.15Upgrade linux-oracle-5.15Upgrade linux-ibm-5.4Upgrade linux-oracle-5.4Upgrade linux-raspiUpgrade linux-fipsUpgrade linux-riscv-5.15Upgrade linux-awsUpgrade linux-azureUpgrade linux-ibmUpgrade linux-gcp-4.15Upgrade linux-azure-5.4Upgrade linux-gcp-fipsUpgrade linux-hweUpgrade linux-hwe-5.4Upgrade linux-kvmUpgrade linux-nvidiaUpgrade linux-azure-fipsUpgrade linux-gcpUpgrade linux-azure-5.15Upgrade linux-azure-4.15Upgrade linux-gkeopUpgrade linux-gcp-5.4Upgrade linux-iotUpgrade linux-oracleUpgrade linux-gcp-5.15Upgrade linux-azure-fde-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-aws-fipsUpgrade linux-intel-iotg-5.15Upgrade linux-xilinx-zynqmp | Sep 26, 2025 | Sep 18, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Sep 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub