CVE-2025-68373

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> md: avoid repeated calls to del_gendisk<br /> <br /> There is a uaf problem which is found by case 23rdev-lifetime:<br /> <br /> Oops: general protection fault, probably for non-canonical address 0xdead000000000122<br /> RIP: 0010:bdi_unregister+0x4b/0x170<br /> Call Trace:<br /> <br /> __del_gendisk+0x356/0x3e0<br /> mddev_unlock+0x351/0x360<br /> rdev_attr_store+0x217/0x280<br /> kernfs_fop_write_iter+0x14a/0x210<br /> vfs_write+0x29e/0x550<br /> ksys_write+0x74/0xf0<br /> do_syscall_64+0xbb/0x380<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> RIP: 0033:0x7ff5250a177e<br /> <br /> The sequence is:<br /> 1. rdev remove path gets reconfig_mutex<br /> 2. rdev remove path release reconfig_mutex in mddev_unlock<br /> 3. md stop calls do_md_stop and sets MD_DELETED<br /> 4. rdev remove path calls del_gendisk because MD_DELETED is set<br /> 5. md stop path release reconfig_mutex and calls del_gendisk again<br /> <br /> So there is a race condition we should resolve. This patch adds a<br /> flag MD_DO_DELETE to avoid the race condition.