CVE-2025-38445

HIGH EPSS 6.1%

Published Jul 25, 202511mo ago · Modified Jun 17, 20261w ago

7.1 CVSS 3.1

High

Published Jul 25, 2025 11mo ago

Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix stack memory use after return in raid1_reshape In the raid1_reshape function, newpool is allocated on the stack and assigned to conf->r1bio_pool. This results in conf->r1bio_pool.wait.head pointing to a stack address. Accessing this address later can lead to a kernel panic. Example access path: raid1_reshape() { // newpool is on the stack mempool_t newpool, oldpool; // initialize newpool.wait.head to stack address mempool_init(&newpool, ...); conf->r1bio_pool = newpool; } raid1_read_request() or raid1_write_request() { alloc_r1bio() { mempool_alloc() { // if pool->alloc fails remove_element() { --pool->curr_nr; } } } } mempool_free() { if (pool->curr_nr < pool->min_nr) { // pool->wait.head is a stack address // wake_up() will try to access this invalid address // which leads to a kernel panic return; wake_up(&pool->wait); } } Fix: reinit conf->r1bio_pool.wait after assigning newpool.

CVSS Details

Base Score

7.1

Exploitability

1.8

Impact

5.2

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

6.1% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 13

Vendor	Product	Version	Range
linux	linux_kernel	*	≥4.18 – <5.4.296
linux	linux_kernel	*	≥5.5 – <5.10.240
linux	linux_kernel	*	≥5.11 – <5.15.189
linux	linux_kernel	*	≥5.16 – <6.1.146
linux	linux_kernel	*	≥6.2 – <6.6.99
linux	linux_kernel	*	≥6.7 – <6.12.39
linux	linux_kernel	*	≥6.13 – <6.15.7
linux	linux_kernel	6.16	any
linux	linux_kernel	6.16	any
linux	linux_kernel	6.16	any
linux	linux_kernel	6.16	any
linux	linux_kernel	6.16	any
debian	debian_linux	11.0	any

References 10

git.kernel.org https://git.kernel.org/stable/c/12b00ec99624f8da8c325f2dd6e807df26df0025

Patch
git.kernel.org https://git.kernel.org/stable/c/48da050b4f54ed639b66278d0ae6f4107b2c4e2d

Patch
git.kernel.org https://git.kernel.org/stable/c/5f35e48b76655e45522df338876dfef88dafcc71

Patch
git.kernel.org https://git.kernel.org/stable/c/61fd5e93006cf82ec8ee5c115ab5cf4bbd104bdb

Patch
git.kernel.org https://git.kernel.org/stable/c/776e6186dc9ecbdb8a1b706e989166c8a99bbf64

Patch
git.kernel.org https://git.kernel.org/stable/c/d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98

Patch
git.kernel.org https://git.kernel.org/stable/c/d8a6853d00fbaa810765c8ed2f452a5832273968

Patch
git.kernel.org https://git.kernel.org/stable/c/df5894014a92ff0196dbc212a7764e97366fd2b7

Patch
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

Third Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Third Party Advisory

Remediation

git.kernel.org https://git.kernel.org/stable/c/12b00ec99624f8da8c325f2dd6e807df26df0025

Patch
git.kernel.org https://git.kernel.org/stable/c/48da050b4f54ed639b66278d0ae6f4107b2c4e2d

Patch
git.kernel.org https://git.kernel.org/stable/c/5f35e48b76655e45522df338876dfef88dafcc71

Patch
git.kernel.org https://git.kernel.org/stable/c/61fd5e93006cf82ec8ee5c115ab5cf4bbd104bdb

Patch
git.kernel.org https://git.kernel.org/stable/c/776e6186dc9ecbdb8a1b706e989166c8a99bbf64

Patch
git.kernel.org https://git.kernel.org/stable/c/d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98

Patch
git.kernel.org https://git.kernel.org/stable/c/d8a6853d00fbaa810765c8ed2f452a5832273968

Patch
git.kernel.org https://git.kernel.org/stable/c/df5894014a92ff0196dbc212a7764e97366fd2b7

Patch