{"id":"CVE-2025-21712","revision":"a4af90928cc141908665c47174c89b66","records":[{"revision":"a4af90928cc141908665c47174c89b66","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-21712","aliases":[],"title":"md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime\n\nAfter commit ec6bb299c7c3 (\"md/md-bitmap: add 'sync_size' into struct\nmd_bitmap_stats\"), following panic is reported:\n\nOops: general protection fault, probably for non-canonical address\nRIP: 0010:bitmap_get_stats+0x2b/0xa0\nCall Trace:\n <TASK>\n md_seq_show+0x2d2/0x5b0\n seq_read_iter+0x2b9/0x470\n seq_read+0x12f/0x180\n proc_reg_read+0x57/0xb0\n vfs_read+0xf6/0x380\n ksys_read+0x6c/0xf0\n do_syscall_64+0x82/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nRoot cause is that bitmap_get_stats() can be called at anytime if mddev\nis still there, even if bitmap is destroyed, or not fully initialized.\nDeferenceing bitmap in this case can crash the kernel. Meanwhile, the\nabove commit start to deferencing bitmap->storage, make the problem\neasier to trigger.\n\nFix the problem by protecting bitmap_get_stats() with bitmap_info.mutex.","state":0,"publishedAt":"2025-02-27T02:07:24.354+00:00","modifiedAt":"2026-10-15T21:51:52.411+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/md-bitmap.c\",\n                        \"drivers/md/md.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"32a7627cf3a35396a8e834faf34e38ae9f3b1309\",\n                            \"lessThan\": \"eb2f9d98cd3e94a79fbf8fb90637c5b12e805428\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"32a7627cf3a35396a8e834faf34e38ae9f3b1309\",\n                            \"lessThan\": \"032fa54f486eac5507976e7e31f079a767bc13a8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"32a7627cf3a35396a8e834faf34e38ae9f3b1309\",\n                            \"lessThan\": \"52848a095b55a302af92f52ca0de5b3112059bb8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"32a7627cf3a35396a8e834faf34e38ae9f3b1309\",\n                            \"lessThan\": \"237e19519c8ff6949f0ef57c4a0243f5b2b0fa18\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"32a7627cf3a35396a8e834faf34e38ae9f3b1309\",\n                            \"lessThan\": \"4e9316eee3885bfb311b4759513f2ccf37891c09\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"32a7627cf3a35396a8e834faf34e38ae9f3b1309\",\n                            \"lessThan\": \"8d28d0ddb986f56920ac97ae704cc3340a699a30\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/md-bitmap.c\",\n                        \"drivers/md/md.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.209\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.130\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.80\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.13\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13.2\",\n                            \"lessThanOrEqual\": \"6.13.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/eb2f9d98cd3e94a79fbf8fb90637c5b12e805428","https://git.kernel.org/stable/c/032fa54f486eac5507976e7e31f079a767bc13a8","https://git.kernel.org/stable/c/52848a095b55a302af92f52ca0de5b3112059bb8","https://git.kernel.org/stable/c/237e19519c8ff6949f0ef57c4a0243f5b2b0fa18","https://git.kernel.org/stable/c/4e9316eee3885bfb311b4759513f2ccf37891c09","https://git.kernel.org/stable/c/8d28d0ddb986f56920ac97ae704cc3340a699a30"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21712","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-21712","identifiers":["CVE-2025-21712"]},"retained":false,"historicalAffected":[]}],"coverage":[]}