CVE-2025-68373

Description

In the Linux kernel, the following vulnerability has been resolved:md: avoid repeated calls to del_gendiskThere is a uaf problem which is found by case 23rdev-lifetime:Oops: general protection fault, probably for non-canonical address 0xdead000000000122RIP: 0010:bdi_unregister+0x4b/0x170Call Trace: __del_gendisk+0x356/0x3e0 mddev_unlock+0x351/0x360 rdev_attr_store+0x217/0x280 kernfs_fop_write_iter+0x14a/0x210 vfs_write+0x29e/0x550 ksys_write+0x74/0xf0 do_syscall_64+0xbb/0x380 entry_SYSCALL_64_after_hwframe+0x77/0x7fRIP: 0033:0x7ff5250a177eThe sequence is:1. rdev remove path gets reconfig_mutex2. rdev remove path release reconfig_mutex in mddev_unlock3. md stop calls do_md_stop and sets MD_DELETED4. rdev remove path calls del_gendisk because MD_DELETED is set5. md stop path release reconfig_mutex and calls del_gendisk againSo there is a race condition we should resolve. This patch adds aflag MD_DO_DELETE to avoid the race condition.

Risk Information

Base Score

4.7

MODERATE

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.025

Associated Vulnerability

No records found

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234