In the Linux kernel, the following vulnerability has been resolved:
md: fix mddev uaf while iterating all_mddevs list
While iterating allmddevs list from mdnotifyreboot() and mdexit(), listforeachentrysafe is used, and this can race with deletint the next mddev, causing UAF:
t1: spinlock //listforeachentrysafe(mddev, n, ...) mddevget(mddev1) // assume mddev2 is the next entry spinunlock t2: //remove mddev2 ... mddevfree spinlock listdel spinunlock kfree(mddev2) mddevput(mddev1) spinlock //continue dereference mddev2->allmddevs
The old helper foreachmddev() actually grab the reference of mddev2 while holding the lock, to prevent from being freed. This problem can be fixed the same way, however, the code will be complex.
Hence switch to use listforeachentry, in this case mddevput() can free the mddev1 and it's not safe as well. Refer to mdseqshow(), also factor out a helper mddevputlocked() to fix this problem.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22126.json"
}[
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-12a0ea76",
"target": {
"file": "drivers/md/md.c",
"function": "md_seq_show"
},
"digest": {
"length": 2441.0,
"function_hash": "264157903126612595414097695788053416235"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d69a23d8e925f8052d657652a6875ec2712c7e33"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-16627da4",
"target": {
"file": "drivers/md/md.c",
"function": "md_exit"
},
"digest": {
"length": 758.0,
"function_hash": "55723492914928537107220945074918493522"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8542870237c3a48ff049b6c5df5f50c8728284fa"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-31d352c7",
"target": {
"file": "drivers/md/md.c",
"function": "md_seq_show"
},
"digest": {
"length": 2566.0,
"function_hash": "316307616885469143101256147584417599388"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5462544ccbad3fc938a71b01fa5bd3a0dc2b750a"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2025-22126-3813abdb",
"target": {
"file": "drivers/md/md.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"256713397592851412776079750380289434619",
"285498720494039822659612491896496655137",
"173792649382535274234317251733052314756",
"267545312880957590423396453379191269494",
"161669249988971068076668785577849230505",
"21343687862718971613356098391050723087",
"177956135307451131269782229117604763157",
"86408264289078480975134579716169646698",
"320091254676834219377017077786984434089",
"18003739451382553205381170977620731815",
"155182380107132198015488486537196621424",
"260193866165975703888448662712526243467",
"114003478532873056316927477700123730023",
"168468908883183128823531787364526318355",
"96526952104016288177970768639537976960",
"299370063714694586327751157242623404215",
"160579398051676562370913778197276480462",
"265979324431187106000889656393023270970",
"286207367550871152928797367836594979014",
"239076635090400713566084297377896167569",
"121731483301932803650805949680745028845",
"187114553035298429778989387409043722063",
"16235434545623933334265247453265168189",
"90742407445264672794618129145039622593",
"184995433841583345458901487580281080600",
"59526245422044070227046002604897351387",
"168468908883183128823531787364526318355",
"96526952104016288177970768639537976960",
"208691310728849401252413962546749132876",
"282826268526178555596853571301114935271",
"104204473339238637296683253852551676430",
"286207367550871152928797367836594979014",
"35396238140035067940400327263840927485"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d69a23d8e925f8052d657652a6875ec2712c7e33"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-3a16c985",
"target": {
"file": "drivers/md/md.c",
"function": "md_exit"
},
"digest": {
"length": 758.0,
"function_hash": "55723492914928537107220945074918493522"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5462544ccbad3fc938a71b01fa5bd3a0dc2b750a"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-3d4ea6f0",
"target": {
"file": "drivers/md/md.c",
"function": "md_notify_reboot"
},
"digest": {
"length": 573.0,
"function_hash": "59272461247435734366241647150590864241"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d69a23d8e925f8052d657652a6875ec2712c7e33"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-4403cbb2",
"target": {
"file": "drivers/md/md.c",
"function": "md_notify_reboot"
},
"digest": {
"length": 573.0,
"function_hash": "59272461247435734366241647150590864241"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8542870237c3a48ff049b6c5df5f50c8728284fa"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-6ad8adca",
"target": {
"file": "drivers/md/md.c",
"function": "md_seq_show"
},
"digest": {
"length": 2573.0,
"function_hash": "133301897953135926021263601625240483417"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8542870237c3a48ff049b6c5df5f50c8728284fa"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-72ef72e2",
"target": {
"file": "drivers/md/md.c",
"function": "md_exit"
},
"digest": {
"length": 761.0,
"function_hash": "338974111352770098371209884801898601538"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca9f84de76723b358dfc0606668efdca54afc2e5"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2025-22126-798fc703",
"target": {
"file": "drivers/md/md.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"3332625615559950536858645580595964639",
"285498720494039822659612491896496655137",
"173792649382535274234317251733052314756",
"320091254676834219377017077786984434089",
"18003739451382553205381170977620731815",
"155182380107132198015488486537196621424",
"260193866165975703888448662712526243467",
"114003478532873056316927477700123730023",
"168468908883183128823531787364526318355",
"96526952104016288177970768639537976960",
"299370063714694586327751157242623404215",
"160579398051676562370913778197276480462",
"265979324431187106000889656393023270970",
"286207367550871152928797367836594979014",
"239076635090400713566084297377896167569",
"121731483301932803650805949680745028845",
"187114553035298429778989387409043722063",
"16235434545623933334265247453265168189",
"90742407445264672794618129145039622593",
"184995433841583345458901487580281080600",
"59526245422044070227046002604897351387",
"168468908883183128823531787364526318355",
"96526952104016288177970768639537976960",
"208691310728849401252413962546749132876",
"282826268526178555596853571301114935271",
"104204473339238637296683253852551676430",
"286207367550871152928797367836594979014",
"147494372357686586348519083808582945919"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca9f84de76723b358dfc0606668efdca54afc2e5"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2025-22126-8898d62a",
"target": {
"file": "drivers/md/md.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"256713397592851412776079750380289434619",
"285498720494039822659612491896496655137",
"173792649382535274234317251733052314756",
"267545312880957590423396453379191269494",
"161669249988971068076668785577849230505",
"21343687862718971613356098391050723087",
"177956135307451131269782229117604763157",
"86408264289078480975134579716169646698",
"320091254676834219377017077786984434089",
"18003739451382553205381170977620731815",
"155182380107132198015488486537196621424",
"260193866165975703888448662712526243467",
"114003478532873056316927477700123730023",
"168468908883183128823531787364526318355",
"96526952104016288177970768639537976960",
"299370063714694586327751157242623404215",
"160579398051676562370913778197276480462",
"265979324431187106000889656393023270970",
"286207367550871152928797367836594979014",
"239076635090400713566084297377896167569",
"121731483301932803650805949680745028845",
"187114553035298429778989387409043722063",
"16235434545623933334265247453265168189",
"90742407445264672794618129145039622593",
"184995433841583345458901487580281080600",
"59526245422044070227046002604897351387",
"168468908883183128823531787364526318355",
"96526952104016288177970768639537976960",
"208691310728849401252413962546749132876",
"282826268526178555596853571301114935271",
"104204473339238637296683253852551676430",
"286207367550871152928797367836594979014",
"35396238140035067940400327263840927485"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a9f73ee408a460f4c9dfe03b4741d6b11652b8"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2025-22126-8a01ed1e",
"target": {
"file": "drivers/md/md.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"256713397592851412776079750380289434619",
"285498720494039822659612491896496655137",
"173792649382535274234317251733052314756",
"267545312880957590423396453379191269494",
"161669249988971068076668785577849230505",
"21343687862718971613356098391050723087",
"177956135307451131269782229117604763157",
"86408264289078480975134579716169646698",
"320091254676834219377017077786984434089",
"18003739451382553205381170977620731815",
"155182380107132198015488486537196621424",
"260193866165975703888448662712526243467",
"114003478532873056316927477700123730023",
"168468908883183128823531787364526318355",
"96526952104016288177970768639537976960",
"299370063714694586327751157242623404215",
"160579398051676562370913778197276480462",
"265979324431187106000889656393023270970",
"286207367550871152928797367836594979014",
"239076635090400713566084297377896167569",
"121731483301932803650805949680745028845",
"187114553035298429778989387409043722063",
"16235434545623933334265247453265168189",
"90742407445264672794618129145039622593",
"184995433841583345458901487580281080600",
"59526245422044070227046002604897351387",
"168468908883183128823531787364526318355",
"96526952104016288177970768639537976960",
"208691310728849401252413962546749132876",
"282826268526178555596853571301114935271",
"104204473339238637296683253852551676430",
"286207367550871152928797367836594979014",
"35396238140035067940400327263840927485"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8542870237c3a48ff049b6c5df5f50c8728284fa"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-93060efa",
"target": {
"file": "drivers/md/md.c",
"function": "md_notify_reboot"
},
"digest": {
"length": 573.0,
"function_hash": "59272461247435734366241647150590864241"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5462544ccbad3fc938a71b01fa5bd3a0dc2b750a"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-941424c9",
"target": {
"file": "drivers/md/md.c",
"function": "md_notify_reboot"
},
"digest": {
"length": 573.0,
"function_hash": "59272461247435734366241647150590864241"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca9f84de76723b358dfc0606668efdca54afc2e5"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2025-22126-9c7ef0da",
"target": {
"file": "drivers/md/md.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"256713397592851412776079750380289434619",
"285498720494039822659612491896496655137",
"173792649382535274234317251733052314756",
"267545312880957590423396453379191269494",
"161669249988971068076668785577849230505",
"21343687862718971613356098391050723087",
"177956135307451131269782229117604763157",
"86408264289078480975134579716169646698",
"320091254676834219377017077786984434089",
"18003739451382553205381170977620731815",
"155182380107132198015488486537196621424",
"260193866165975703888448662712526243467",
"114003478532873056316927477700123730023",
"168468908883183128823531787364526318355",
"96526952104016288177970768639537976960",
"299370063714694586327751157242623404215",
"160579398051676562370913778197276480462",
"265979324431187106000889656393023270970",
"286207367550871152928797367836594979014",
"239076635090400713566084297377896167569",
"121731483301932803650805949680745028845",
"187114553035298429778989387409043722063",
"16235434545623933334265247453265168189",
"90742407445264672794618129145039622593",
"184995433841583345458901487580281080600",
"59526245422044070227046002604897351387",
"168468908883183128823531787364526318355",
"96526952104016288177970768639537976960",
"208691310728849401252413962546749132876",
"282826268526178555596853571301114935271",
"104204473339238637296683253852551676430",
"286207367550871152928797367836594979014",
"35396238140035067940400327263840927485"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5462544ccbad3fc938a71b01fa5bd3a0dc2b750a"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-ab812916",
"target": {
"file": "drivers/md/md.c",
"function": "md_notify_reboot"
},
"digest": {
"length": 573.0,
"function_hash": "59272461247435734366241647150590864241"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a9f73ee408a460f4c9dfe03b4741d6b11652b8"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-e039d196",
"target": {
"file": "drivers/md/md.c",
"function": "md_exit"
},
"digest": {
"length": 758.0,
"function_hash": "55723492914928537107220945074918493522"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a9f73ee408a460f4c9dfe03b4741d6b11652b8"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-e05ee740",
"target": {
"file": "drivers/md/md.c",
"function": "md_exit"
},
"digest": {
"length": 758.0,
"function_hash": "55723492914928537107220945074918493522"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d69a23d8e925f8052d657652a6875ec2712c7e33"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-22126-e355eb79",
"target": {
"file": "drivers/md/md.c",
"function": "md_seq_show"
},
"digest": {
"length": 2566.0,
"function_hash": "316307616885469143101256147584417599388"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a9f73ee408a460f4c9dfe03b4741d6b11652b8"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22126.json"