CVE-2025-38445

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> md/raid1: Fix stack memory use after return in raid1_reshape<br /> <br /> In the raid1_reshape function, newpool is<br /> allocated on the stack and assigned to conf-&gt;r1bio_pool.<br /> This results in conf-&gt;r1bio_pool.wait.head pointing<br /> to a stack address.<br /> Accessing this address later can lead to a kernel panic.<br /> <br /> Example access path:<br /> <br /> raid1_reshape()<br /> {<br /> // newpool is on the stack<br /> mempool_t newpool, oldpool;<br /> // initialize newpool.wait.head to stack address<br /> mempool_init(&amp;newpool, ...);<br /> conf-&gt;r1bio_pool = newpool;<br /> }<br /> <br /> raid1_read_request() or raid1_write_request()<br /> {<br /> alloc_r1bio()<br /> {<br /> mempool_alloc()<br /> {<br /> // if pool-&gt;alloc fails<br /> remove_element()<br /> {<br /> --pool-&gt;curr_nr;<br /> }<br /> }<br /> }<br /> }<br /> <br /> mempool_free()<br /> {<br /> if (pool-&gt;curr_nr min_nr) {<br /> // pool-&gt;wait.head is a stack address<br /> // wake_up() will try to access this invalid address<br /> // which leads to a kernel panic<br /> return;<br /> wake_up(&amp;pool-&gt;wait);<br /> }<br /> }<br /> <br /> Fix:<br /> reinit conf-&gt;r1bio_pool.wait after assigning newpool.