{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-22124","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-29T08:45:45.823Z","datePublished":"2025-04-16T14:13:08.134Z","dateUpdated":"2026-08-05T11:56:57.558Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:56:57.558Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/md-bitmap: fix wrong bitmap_limit for clustermd when write sb\n\nIn clustermd, separate write-intent-bitmaps are used for each cluster\nnode:\n\n0                    4k                     8k                    12k\n-------------------------------------------------------------------\n| idle                | md super            | bm super [0] + bits |\n| bm bits[0, contd]   | bm super[1] + bits  | bm bits[1, contd]   |\n| bm super[2] + bits  | bm bits [2, contd]  | bm super[3] + bits  |\n| bm bits [3, contd]  |                     |                     |\n\nSo in node 1, pg_index in __write_sb_page() could equal to\nbitmap->storage.file_pages. Then bitmap_limit will be calculated to\n0. md_super_write() will be called with 0 size.\nThat means the first 4k sb area of node 1 will never be updated\nthrough filemap_write_page().\nThis bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize.\n\nHere use (pg_index % bitmap->storage.file_pages) to make calculation\nof bitmap_limit correct."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is in the md bitmap writeback path of a local block device stack, reached via I/O to a clustered md array on the local system. No remote attacker input reaches `__write_sb_page()` directly.\nAC:L - On a clustered md array the miscalculation is deterministic for every node with cluster_slot >= 1 — no race, no memory-layout dependency, and it fires on every bitmap superblock/page writeback driven by ordinary I/O.\nPR:L - The buggy path carries no capability check; an unprivileged local user writing to a filesystem backed by the clustered md array dirties bitmap pages and triggers the writeback. Array configuration is a deployment precondition, not a privilege the attacker must hold.\nUI:N - No victim action is needed — the flawed write occurs automatically during normal bitmap superblock updates and daemon writeback.\nS:U - The out-of-bounds read, on-disk metadata corruption, and hang all stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - With the clamp defeated by the unsigned underflow, up to `bdev_io_opt()` bytes (commonly 256KB) are read from a single bitmap page, leaking ~252KB of adjacent kernel memory into the RAID member's on-disk metadata area — and over the network for nvme-tcp backing devices — where it is recoverable by anyone able to read the raw device.\nI:H - The oversized write overruns the node's own bitmap slot and overwrites neighbouring cluster nodes' on-disk write-intent bitmaps with arbitrary kernel memory, while the zero-length-write variant leaves the bitmap superblock permanently stale so post-crash resync skips genuinely dirty regions, silently diverging the mirrors.\nA:H - The commit documents a hang of the cluster grow/resize path, the original bug this regresses caused `mdadm` to hang on nvme-tcp via `sendpage_ok()` failure, and the out-of-bounds page walk can touch unmapped memory and oops."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/md-bitmap.c"],"versions":[{"version":"ab99a87542f194f28e2364a42afbf9fb48b1c724","lessThan":"60196f92bbc7901eb5cfa5d456651b87ea50a4a3","status":"affected","versionType":"git"},{"version":"ab99a87542f194f28e2364a42afbf9fb48b1c724","lessThan":"bc3a9788961631359527763d7e1fcf26554c7cb1","status":"affected","versionType":"git"},{"version":"ab99a87542f194f28e2364a42afbf9fb48b1c724","lessThan":"6130825f34d41718c98a9b1504a79a23e379701e","status":"affected","versionType":"git"},{"version":"655cc01889fa9b65441922565cddee64af49e6d6","status":"affected","versionType":"git"},{"version":"5600d6013c634c2b6b6c6c55c8ecb50c3a6211f2","status":"affected","versionType":"git"},{"version":"6.6.44","lessThan":"6.7","status":"affected","versionType":"semver"},{"version":"6.10.3","lessThan":"6.11","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/md-bitmap.c"],"versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","status":"unaffected","versionType":"semver"},{"version":"6.12.46","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.14.2","lessThanOrEqual":"6.14.*","status":"unaffected","versionType":"semver"},{"version":"6.15","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.14.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/60196f92bbc7901eb5cfa5d456651b87ea50a4a3"},{"url":"https://git.kernel.org/stable/c/bc3a9788961631359527763d7e1fcf26554c7cb1"},{"url":"https://git.kernel.org/stable/c/6130825f34d41718c98a9b1504a79a23e379701e"}],"title":"md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb","x_generator":{"engine":"bippy-1.2.0"}}}}