GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-22124 (GCVE-0-2025-22124)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:13 – Updated: 2026-09-14 11:57
VLAI
Title
md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
Summary
In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb In clustermd, separate write-intent-bitmaps are used for each cluster node: 0 4k 8k 12k ------------------------------------------------------------------- | idle | md super | bm super [0] + bits | | bm bits[0, contd] | bm super[1] + bits | bm bits[1, contd] | | bm super[2] + bits | bm bits [2, contd] | bm super[3] + bits | | bm bits [3, contd] | | | So in node 1, pg_index in __write_sb_page() could equal to bitmap->storage.file_pages. Then bitmap_limit will be calculated to 0. md_super_write() will be called with 0 size. That means the first 4k sb area of node 1 will never be updated through filemap_write_page(). This bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize. Here use (pg_index % bitmap->storage.file_pages) to make calculation of bitmap_limit correct.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 655cc01889fa9b65441922565cddee64af49e6d6 , < 5eaf57fdfa37c869e61e9908e03edd707f9145b8 (git)
Affected: ab99a87542f194f28e2364a42afbf9fb48b1c724 , < 60196f92bbc7901eb5cfa5d456651b87ea50a4a3 (git)
Affected: ab99a87542f194f28e2364a42afbf9fb48b1c724 , < bc3a9788961631359527763d7e1fcf26554c7cb1 (git)
Affected: ab99a87542f194f28e2364a42afbf9fb48b1c724 , < 6130825f34d41718c98a9b1504a79a23e379701e (git)
Affected: 5600d6013c634c2b6b6c6c55c8ecb50c3a6211f2 (git)
Affected: 6.6.44 , < 6.6.157 (semver)
Affected: 6.10.3 , < 6.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.46 , ≤ 6.12.* (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/md-bitmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5eaf57fdfa37c869e61e9908e03edd707f9145b8",
              "status": "affected",
              "version": "655cc01889fa9b65441922565cddee64af49e6d6",
              "versionType": "git"
            },
            {
              "lessThan": "60196f92bbc7901eb5cfa5d456651b87ea50a4a3",
              "status": "affected",
              "version": "ab99a87542f194f28e2364a42afbf9fb48b1c724",
              "versionType": "git"
            },
            {
              "lessThan": "bc3a9788961631359527763d7e1fcf26554c7cb1",
              "status": "affected",
              "version": "ab99a87542f194f28e2364a42afbf9fb48b1c724",
              "versionType": "git"
            },
            {
              "lessThan": "6130825f34d41718c98a9b1504a79a23e379701e",
              "status": "affected",
              "version": "ab99a87542f194f28e2364a42afbf9fb48b1c724",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5600d6013c634c2b6b6c6c55c8ecb50c3a6211f2",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/md-bitmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/md-bitmap: fix wrong bitmap_limit for clustermd when write sb\n\nIn clustermd, separate write-intent-bitmaps are used for each cluster\nnode:\n\n0                    4k                     8k                    12k\n-------------------------------------------------------------------\n| idle                | md super            | bm super [0] + bits |\n| bm bits[0, contd]   | bm super[1] + bits  | bm bits[1, contd]   |\n| bm super[2] + bits  | bm bits [2, contd]  | bm super[3] + bits  |\n| bm bits [3, contd]  |                     |                     |\n\nSo in node 1, pg_index in __write_sb_page() could equal to\nbitmap-\u003estorage.file_pages. Then bitmap_limit will be calculated to\n0. md_super_write() will be called with 0 size.\nThat means the first 4k sb area of node 1 will never be updated\nthrough filemap_write_page().\nThis bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize.\n\nHere use (pg_index % bitmap-\u003estorage.file_pages) to make calculation\nof bitmap_limit correct."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is in the md bitmap writeback path of a local block device stack, reached via I/O to a clustered md array on the local system. No remote attacker input reaches `__write_sb_page()` directly.\nAC:L - On a clustered md array the miscalculation is deterministic for every node with cluster_slot \u003e= 1 \u2014 no race, no memory-layout dependency, and it fires on every bitmap superblock/page writeback driven by ordinary I/O.\nPR:L - The buggy path carries no capability check; an unprivileged local user writing to a filesystem backed by the clustered md array dirties bitmap pages and triggers the writeback. Array configuration is a deployment precondition, not a privilege the attacker must hold.\nUI:N - No victim action is needed \u2014 the flawed write occurs automatically during normal bitmap superblock updates and daemon writeback.\nS:U - The out-of-bounds read, on-disk metadata corruption, and hang all stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - With the clamp defeated by the unsigned underflow, up to `bdev_io_opt()` bytes (commonly 256KB) are read from a single bitmap page, leaking ~252KB of adjacent kernel memory into the RAID member\u0027s on-disk metadata area \u2014 and over the network for nvme-tcp backing devices \u2014 where it is recoverable by anyone able to read the raw device.\nI:H - The oversized write overruns the node\u0027s own bitmap slot and overwrites neighbouring cluster nodes\u0027 on-disk write-intent bitmaps with arbitrary kernel memory, while the zero-length-write variant leaves the bitmap superblock permanently stale so post-crash resync skips genuinely dirty regions, silently diverging the mirrors.\nA:H - The commit documents a hang of the cluster grow/resize path, the original bug this regresses caused `mdadm` to hang on nvme-tcp via `sendpage_ok()` failure, and the out-of-bounds page walk can touch unmapped memory and oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:57:56.837Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5eaf57fdfa37c869e61e9908e03edd707f9145b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/60196f92bbc7901eb5cfa5d456651b87ea50a4a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc3a9788961631359527763d7e1fcf26554c7cb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/6130825f34d41718c98a9b1504a79a23e379701e"
        }
      ],
      "title": "md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22124",
    "datePublished": "2025-04-16T14:13:08.134Z",
    "dateReserved": "2024-12-29T08:45:45.823Z",
    "dateUpdated": "2026-09-14T11:57:56.837Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22124",
      "date": "2026-09-17",
      "epss": "0.00198",
      "percentile": "0.09888"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-13T01:50:27.000Z",
      "cve": "CVE-2025-22124",
      "id": "msrc_CVE-2025-22124",
      "initial_release_date": "2025-11-05T01:01:50.000Z",
      "product_status:known_affected": "17",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-22124.json",
      "version": "18"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22124\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-16T15:16:06.540\",\"lastModified\":\"2026-09-14T12:17:35.497\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmd/md-bitmap: fix wrong bitmap_limit for clustermd when write sb\\n\\nIn clustermd, separate write-intent-bitmaps are used for each cluster\\nnode:\\n\\n0                    4k                     8k                    12k\\n-------------------------------------------------------------------\\n| idle                | md super            | bm super [0] + bits |\\n| bm bits[0, contd]   | bm super[1] + bits  | bm bits[1, contd]   |\\n| bm super[2] + bits  | bm bits [2, contd]  | bm super[3] + bits  |\\n| bm bits [3, contd]  |                     |                     |\\n\\nSo in node 1, pg_index in __write_sb_page() could equal to\\nbitmap-\u003estorage.file_pages. Then bitmap_limit will be calculated to\\n0. md_super_write() will be called with 0 size.\\nThat means the first 4k sb area of node 1 will never be updated\\nthrough filemap_write_page().\\nThis bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize.\\n\\nHere use (pg_index % bitmap-\u003estorage.file_pages) to make calculation\\nof bitmap_limit correct.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: md/md-bitmap: corrige bitmap_limit incorrecto para clustermd al escribir sb En clustermd, se usan mapas de bits de intenci\u00f3n de escritura separados para cada nodo del cl\u00faster: 0 4k 8k 12k ------------------------------------------------------------------- | idle | md super | bm super [0] + bits | | bm bits[0, contd] | bm super[1] + bits | bm bits[1, contd] | | bm super[2] + bits | bm bits [2, contd] | bm super[3] + bits | | bm bits [3, contd] | | | Entonces, en el nodo 1, pg_index en __write_sb_page() podr\u00eda ser igual a bitmap-\u0026gt;storage.file_pages. Entonces, bitmap_limit se calcular\u00e1 como 0. md_super_write() se llamar\u00e1 con un tama\u00f1o de 0. Esto significa que la primera \u00e1rea de 4k del nodo 1 nunca se actualizar\u00e1 mediante filemap_write_page(). Este error provoca el bloqueo de mdadm/clustermd_tests/01r1_Grow_resize. En este caso, utilice (pg_index % bitmap-\u0026gt;storage.file_pages) para que el c\u00e1lculo de bitmap_limit sea correcto.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/md-bitmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"655cc01889fa9b65441922565cddee64af49e6d6\",\"lessThan\":\"5eaf57fdfa37c869e61e9908e03edd707f9145b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ab99a87542f194f28e2364a42afbf9fb48b1c724\",\"lessThan\":\"60196f92bbc7901eb5cfa5d456651b87ea50a4a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ab99a87542f194f28e2364a42afbf9fb48b1c724\",\"lessThan\":\"bc3a9788961631359527763d7e1fcf26554c7cb1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ab99a87542f194f28e2364a42afbf9fb48b1c724\",\"lessThan\":\"6130825f34d41718c98a9b1504a79a23e379701e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5600d6013c634c2b6b6c6c55c8ecb50c3a6211f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.44\",\"lessThan\":\"6.6.157\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.10.3\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/md-bitmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.46\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.2\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.44\",\"versionEndExcluding\":\"6.7\",\"matchCriteriaId\":\"7D3276FE-8702-415A-8C4D-382A8F3F8D3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10.3\",\"versionEndExcluding\":\"6.12.46\",\"matchCriteriaId\":\"EEBB6B04-47A8-4B7D-BC19-E09F6715D820\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.2\",\"matchCriteriaId\":\"633A38C1-75C8-452D-8F1C-DA0269FD2687\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5eaf57fdfa37c869e61e9908e03edd707f9145b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/60196f92bbc7901eb5cfa5d456651b87ea50a4a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6130825f34d41718c98a9b1504a79a23e379701e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bc3a9788961631359527763d7e1fcf26554c7cb1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:36:16+00:00",
      "cve": "CVE-2025-22124",
      "id": "CVE-2025-22124",
      "initial_release_date": "2025-04-16T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22124.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.