In the Linux kernel, the following vulnerability has been resolved:
md: make rdev_addable usable for rcu mode
Our testcase trigger panic:
BUG: kernel NULL pointer dereference, address: 00000000000000e0 ... Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 85 Comm: kworker/2:1 Not tainted 6.16.0+ #94 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Workqueue: md_misc md_start_sync RIP: 0010:rdev_addable+0x4d/0xf0 ... Call Trace: <TASK> md_start_sync+0x329/0x480 process_one_work+0x226/0x6d0 worker_thread+0x19e/0x340 kthread+0x10f/0x250 ret_from_fork+0x14d/0x180 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: raid10 CR2: 00000000000000e0 ---[ end trace 0000000000000000 ]--- RIP: 0010:rdev_addable+0x4d/0xf0
md_spares_need_change in md_start_sync will call rdev_addable which protected by rcu_read_lock/rcu_read_unlock. This rcu context will help protect rdev won't be released, but rdev->mddev will be set to NULL before we call synchronize_rcu in md_kick_rdev_from_array. Fix this by using READ_ONCE and check does rdev->mddev still alive.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.12Upgrade linux | Sep 30, 2026 | Aug 22, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Aug 22, 2025 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-default-livepatchUpgrade kselftests-kmp-defaultUpgrade dtb-allwinnerUpgrade dtb-appleUpgrade dtb-freescaleUpgrade kernel-rt_debugUpgrade kernel-64kb-extraUpgrade kselftests-kmp-rtUpgrade kernel-docsUpgrade ocfs2-kmp-64kbUpgrade dtb-marvellUpgrade dtb-amdUpgrade reiserfs-kmp-rtUpgrade dtb-amazonUpgrade gfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-default-optionalUpgrade gfs2-kmp-azureUpgrade dtb-caviumUpgrade kernel-64kb-optionalUpgrade dtb-xilinxUpgrade cluster-md-kmp-rtUpgrade kernel-develUpgrade kernel-azure-extraUpgrade kernel-debug-develUpgrade kernel-symsUpgrade kernel-64kbUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-debugUpgrade dtb-sprdUpgrade dlm-kmp-rtUpgrade dtb-renesasUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade dtb-broadcomUpgrade dtb-hisiliconUpgrade reiserfs-kmp-64kbUpgrade kernel-64kb-develUpgrade dlm-kmp-defaultUpgrade kernel-default-develUpgrade kernel-default-baseUpgrade dlm-kmp-azureUpgrade dtb-socionextUpgrade dtb-exynosUpgrade kernel-azureUpgrade gfs2-kmp-rtUpgrade kernel-rt-optionalUpgrade dtb-apmUpgrade kselftests-kmp-64kbUpgrade kernel-debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-develUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-rtUpgrade kernel-rtUpgrade kernel-macrosUpgrade dtb-mediatekUpgrade dtb-alteraUpgrade dtb-nvidiaUpgrade kernel-zfcpdumpUpgrade kernel-syms-rtUpgrade kernel-source-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-qcomUpgrade reiserfs-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade kselftests-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-rt-livepatchUpgrade kernel-obs-qaUpgrade kernel-kvmsmallUpgrade kernel-azure-vdsoUpgrade kernel-sourceUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-rt-extraUpgrade kernel-devel-azureUpgrade kernel-source-vanillaUpgrade dtb-armUpgrade dtb-amlogicUpgrade cluster-md-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-default-extra | Dec 5, 2025 | Sep 18, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 21, 2026 | Aug 22, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub