CVE-2025-68368
NULL Pointer Dereference in Linux md Driver Causes Kernel Crash
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves a NULL pointer dereference caused by uninitialized bioset in the mddev_init function. IO operations may occur before md_run(), such as updating metadata after writing to sysfs. Without the bioset being initialized, these operations trigger a NULL pointer dereference, leading to a kernel crash. The issue arises because mddev_init() can only be called once per mddev, so there is no need to check if bioset has been initialized again.
How can this vulnerability impact me? :
This vulnerability can cause a kernel NULL pointer dereference, which results in a kernel crash (BUG). This can lead to system instability, potential denial of service, and interruption of normal operations on systems using the affected Linux kernel md subsystem.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the NULL pointer dereference using the provided commands that interact with the md device. Specifically, you can run the following commands to test for the issue: mdadm -CR /dev/md0 -l1 -n2 /dev/sd[cd] echo inactive > /sys/block/md0/md/array_state echo 10 > /sys/block/md0/md/new_level If these commands cause a kernel NULL pointer dereference or system crash, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves ensuring that the bioset is properly initialized before any IO operations that update metadata are performed on md devices. Since mddev_init() can only be called once per mddev and bioset initialization is now handled correctly, updating the Linux kernel to a version that includes this fix will mitigate the vulnerability.