CVE-2025-68368

Summary

The md driver in the Linux kernel failed to initialize its bioset in mddev_init(), causing a NULL pointer dereference if metadata update operations are triggered before the device has been fully started via md_run(). This affects the md_update_sb() call path when writing to sysfs attributes such as new_level, as shown in the crash trace where the kernel tries to access offset 0x20 of a NULL pointer [1].

Exploitation

An attacker with local access and the ability to write to the sysfs interface for an md device can trigger this vulnerability. The reproducer involves creating a RAID1 array with mdadm, setting the array state to 'inactive', and then writing to the new_level attribute. This sequence causes md_update_sb() to be invoked before the device metadata structures are fully set up, leading to a crash [1]. No special privileges beyond write access to the md sysfs files are required.

Impact

A successful exploit causes a kernel NULL pointer dereference, resulting in a system crash (denial of service). The bug is easily reproducible and can be triggered by any local user capable of manipulating md devices via sysfs. No privilege escalation or data corruption has been reported.

Mitigation

The fix moves the bioset initialization from md_run() into mddev_init(), ensuring the bioset is always available before any metadata operations. The patch also removes an unnecessary check for prior initialization in mddev_init(), as it is called only once per mddev. The fix has been applied to the Linux kernel stable tree [1].