{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-22124", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.823Z", "datePublished": "2025-04-16T14:13:08.134Z", "dateUpdated": "2026-08-05T11:56:57.558Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:56:57.558Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/md-bitmap: fix wrong bitmap_limit for clustermd when write sb\n\nIn clustermd, separate write-intent-bitmaps are used for each cluster\nnode:\n\n0 4k 8k 12k\n-------------------------------------------------------------------\n| idle | md super | bm super [0] + bits |\n| bm bits[0, contd] | bm super[1] + bits | bm bits[1, contd] |\n| bm super[2] + bits | bm bits [2, contd] | bm super[3] + bits |\n| bm bits [3, contd] | | |\n\nSo in node 1, pg_index in __write_sb_page() could equal to\nbitmap->storage.file_pages. Then bitmap_limit will be calculated to\n0. md_super_write() will be called with 0 size.\nThat means the first 4k sb area of node 1 will never be updated\nthrough filemap_write_page().\nThis bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize.\n\nHere use (pg_index % bitmap->storage.file_pages) to make calculation\nof bitmap_limit correct." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is in the md bitmap writeback path of a local block device stack, reached via I/O to a clustered md array on the local system. No remote attacker input reaches `__write_sb_page()` directly.\nAC:L - On a clustered md array the miscalculation is deterministic for every node with cluster_slot >= 1 — no race, no memory-layout dependency, and it fires on every bitmap superblock/page writeback driven by ordinary I/O.\nPR:L - The buggy path carries no capability check; an unprivileged local user writing to a filesystem backed by the clustered md array dirties bitmap pages and triggers the writeback. Array configuration is a deployment precondition, not a privilege the attacker must hold.\nUI:N - No victim action is needed — the flawed write occurs automatically during normal bitmap superblock updates and daemon writeback.\nS:U - The out-of-bounds read, on-disk metadata corruption, and hang all stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - With the clamp defeated by the unsigned underflow, up to `bdev_io_opt()` bytes (commonly 256KB) are read from a single bitmap page, leaking ~252KB of adjacent kernel memory into the RAID member's on-disk metadata area — and over the network for nvme-tcp backing devices — where it is recoverable by anyone able to read the raw device.\nI:H - The oversized write overruns the node's own bitmap slot and overwrites neighbouring cluster nodes' on-disk write-intent bitmaps with arbitrary kernel memory, while the zero-length-write variant leaves the bitmap superblock permanently stale so post-crash resync skips genuinely dirty regions, silently diverging the mirrors.\nA:H - The commit documents a hang of the cluster grow/resize path, the original bug this regresses caused `mdadm` to hang on nvme-tcp via `sendpage_ok()` failure, and the out-of-bounds page walk can touch unmapped memory and oops." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/md/md-bitmap.c" ], "versions": [ { "version": "ab99a87542f194f28e2364a42afbf9fb48b1c724", "lessThan": "60196f92bbc7901eb5cfa5d456651b87ea50a4a3", "status": "affected", "versionType": "git" }, { "version": "ab99a87542f194f28e2364a42afbf9fb48b1c724", "lessThan": "bc3a9788961631359527763d7e1fcf26554c7cb1", "status": "affected", "versionType": "git" }, { "version": "ab99a87542f194f28e2364a42afbf9fb48b1c724", "lessThan": "6130825f34d41718c98a9b1504a79a23e379701e", "status": "affected", "versionType": "git" }, { "version": "655cc01889fa9b65441922565cddee64af49e6d6", "status": "affected", "versionType": "git" }, { "version": "5600d6013c634c2b6b6c6c55c8ecb50c3a6211f2", "status": "affected", "versionType": "git" }, { "version": "6.6.44", "lessThan": "6.7", "status": "affected", "versionType": "semver" }, { "version": "6.10.3", "lessThan": "6.11", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/md/md-bitmap.c" ], "versions": [ { "version": "6.11", "status": "affected" }, { "version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.46", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.2", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.46" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.14.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.15" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/60196f92bbc7901eb5cfa5d456651b87ea50a4a3" }, { "url": "https://git.kernel.org/stable/c/bc3a9788961631359527763d7e1fcf26554c7cb1" }, { "url": "https://git.kernel.org/stable/c/6130825f34d41718c98a9b1504a79a23e379701e" } ], "title": "md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb", "x_generator": { "engine": "bippy-1.2.0" } } } }