CVE-2025-71225

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md: suspend array while updating raid_disks via sysfs

In raid1_reshape(), freeze_array() is called before modifying the r1bio

memory pool (conf->r1bio_pool) and conf->raid_disks, and

unfreeze_array() is called after the update is completed.

However, freeze_array() only waits until nr_sync_pending and

(nr_pending - nr_queued) of all buckets reaches zero. When an I/O error

occurs, nr_queued is increased and the corresponding r1bio is queued to

either retry_list or bio_end_io_list. As a result, freeze_array() may

unblock before these r1bios are released.

This can lead to a situation where conf->raid_disks and the mempool have

already been updated while queued r1bios, allocated with the old

raid_disks value, are later released. Consequently, free_r1bio() may

access memory out of bounds in put_all_bios() and release r1bios of the

wrong size to the new mempool, potentially causing issues with the

mempool as well.

Since

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References