CVE-2025-38621

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md: make rdev_addable usable for rcu mode

Our testcase trigger panic:

BUG: kernel NULL pointer dereference, address: 00000000000000e0

...

Oops: Oops: 0000 [#1] SMP NOPTI

CPU: 2 UID: 0 PID: 85 Comm: kworker/2:1 Not tainted 6.16.0+ #94

PREEMPT(none)

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS

1.16.1-2.fc37 04/01/2014

Workqueue: md_misc md_start_sync

RIP: 0010:rdev_addable+0x4d/0xf0

...

Call Trace:

<TASK>

md_start_sync+0x329/0x480

process_one_work+0x226/0x6d0

worker_thread+0x19e/0x340

kthread+0x10f/0x250

ret_from_fork+0x14d/0x180

ret_from_fork_asm+0x1a/0x30

</TASK>

Modules linked in: raid10

CR2: 00000000000000e0

---[ end trace 0000000000000000 ]---

RIP: 0010:rdev_addable+0x4d/0xf0

md_spares_need_change in md_start_sync will call rdev_addable which

protected by rcu_read_lock/rcu_read_unlock. This rcu context will help

protect rdev won't be released, but rdev->mddev will be set to NULL

before we

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References