VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Apr 16, 2025· Updated Apr 27, 2026

CVE-2025-22125

CVE-2025-22125

Description

In the Linux kernel, the following vulnerability has been resolved:

md/raid1,raid10: don't ignore IO flags

If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced.

Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks.

Fix those problems by keep IO flags from master bio.

Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT")

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's md/raid1 and raid10 drivers, IO flags like REQ_IDLE, REQ_META, and REQ_NOWAIT are incorrectly stripped from cloned bios, causing performance degradation and priority inversion.

Vulnerability

Description

CVE-2025-22125 is a vulnerability in the Linux kernel's RAID1 and RAID10 drivers within the MD (Multiple Device) subsystem. The root cause is that IO flags from the original master bio are not preserved when creating cloned bios for each mirror/disk. Specifically, flags such as REQ_IDLE, REQ_META, and REQ_NOWAIT are inadvertently cleared or ignored during the cloning process, which undermines the intended I/O behavior.

Exploitation

Context

An attacker or unprivileged user can trigger this condition by performing write I/O to a RAID1 or RAID10 array on a system where blk-wbt (write-back throttling) is enabled. The missing REQ_IDLE flag causes all writes to be throttled by the underlying disks' wbt mechanism, severely degrading write performance. Similarly, discarding REQ_META can lead to priority inversion for filesystem metadata operations, and dropping REQ_NOWAIT causes I/O to wait instead of failing immediately as expected.

Impact

The primary impact is a significant reduction in write performance on RAID1/RAID10 arrays when blk-wbt is active. Additionally, there is a risk of priority inversion where metadata requests lose their elevated priority, and I/O operations that should be non-blocking (REQ_NOWAIT) may become blocking. This can lead to system-wide performance degradation and unexpected I/O delays, though the CVSS score (5.5, Medium) reflects a limited direct security impact as it primarily affects performance rather than integrity or confidentiality.

Mitigation

The vulnerability has been present since the introduction of blk-wbt and was specifically addressed in the commit referenced by the fix (referred to as the commit that introduced REQ_NOWAIT support). The fix involves ensuring that IO flags from the master bio are propagated to all cloned bios. Patches are available in the stable kernel trees via commits such as those referenced [1] [2] [3] [4]; administrators should update their Linux kernel to a version containing the fix.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

89

Patches

3
73506e581c0b
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
8a0adf3d778c
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
e879a0d9cb08
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.