CVE-2025-38621 md: make rdev_addable usable for rcu mode
A null pointer dereference in the Linux kernel's md driver allows local attackers to cause a system crash via a race condition.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38621?
CVE-2025-38621 is a medium-severity vulnerability in Linux kernel, published on 22 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
md: make rdev_addable usable for rcu mode
Our testcase trigger panic:
BUG: kernel NULL pointer dereference, address: 00000000000000e0 ... Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 85 Comm: kworker/2:1 Not tainted 6.16.0+ #94 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Workqueue: md_misc md_start_sync RIP: 0010:rdev_addable+0x4d/0xf0 ... Call Trace: <TASK> md_start_sync+0x329/0x480 process_one_work+0x226/0x6d0 worker_thread+0x19e/0x340 kthread+0x10f/0x250 ret_from_fork+0x14d/0x180 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: raid10 CR2: 00000000000000e0 ---[ end trace 0000000000000000 ]--- RIP: 0010:rdev_addable+0x4d/0xf0
md_spares_need_change in md_start_sync will call rdev_addable which protected by rcu_read_lock/rcu_read_unlock. This rcu context will help protect rdev won't be released, but rdev->mddev will be set to NULL before we call synchronize_rcu in md_kick_rdev_from_array. Fix this by using READ_ONCE and check does rdev->mddev still alive.
Weakness: CWE-476
Which versions are affected by CVE-2025-38621?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38621?
Apply the vendor's patch.
Is CVE-2025-38621 being exploited?
There is no known exploitation of CVE-2025-38621 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38621, DEBIAN-CVE-2025-38621, GHSA-4p23-qfc5-2vc9, ROOT-OS-DEBIAN-13-CVE-2025-38621, ROOT-OS-UBUNTU-2204-CVE-2025-38621, ROOT-OS-UBUNTU-2404-CVE-2025-38621 and 1 more.