CVE-2025-22125 md/raid1,raid10: don't ignore IO flags
Attackers can degrade RAID write performance and cause priority reversals by exploiting ignored IO flags when blk-wbt is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-22125?
CVE-2025-22125 is a medium-severity denial of service vulnerability in Linux kernel, published on 16 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
md/raid1,raid10: don't ignore IO flags
If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced.
Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks.
Fix those problems by keep IO flags from master bio.
Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT")
Which versions are affected by CVE-2025-22125?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-22125?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-22125 being exploited?
There is no known exploitation of CVE-2025-22125 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-62504, AZL-69611, BELL-CVE-2025-22125, DEBIAN-CVE-2025-22125, GHSA-3wr8-w2fq-6q7v, ROOT-OS-DEBIAN-11-CVE-2025-22125 and 5 more.