CVE-2025-22126

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md: fix mddev uaf while iterating all_mddevs list

While iterating all_mddevs list from md_notify_reboot() and md_exit(),

list_for_each_entry_safe is used, and this can race with deletint the

next mddev, causing UAF:

t1:

spin_lock

//list_for_each_entry_safe(mddev, n, ...)

mddev_get(mddev1)

// assume mddev2 is the next entry

spin_unlock

t2:

//remove mddev2

...

mddev_free

spin_lock

list_del

spin_unlock

kfree(mddev2)

mddev_put(mddev1)

spin_lock

//continue dereference mddev2->all_mddevs

The old helper for_each_mddev() actually grab the reference of mddev2

while holding the lock, to prevent from being freed. This problem can be

fixed the same way, however, the code will be complex.

Hence switch to use list_for_each_entry, in this case mddev_put() can free

the mddev1 and it's not safe as well. Refer to md_seq_show(), als

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References