Critical Vulnerability in Linux Kernel: Bitmap Limit Calculation Flaw
Summary
DEBIAN-CVE-2025-22124: In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb In clustermd, separate write-intent-bitmaps are used for each cluster node: 0 4k 8k 12k... Affects linux versions < 6.12.48-1. Fixed in 6.12.48-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting its functionality and security. The specific vulnerability addressed here involves the md/md-bitmap subsystem, which manages metadata for RAID configurations, particularly in clustered environments.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the md/md-bitmap subsystem, where the bitmap limit for clustermd is incorrectly calculated when writing the superblock. This flaw occurs in node 1, where the pg_index in the __write_sb_page() function can equal bitmap->storage.file_pages, resulting in a bitmap_limit of 0. Consequently, the md_super_write() function is called with a size of 0, preventing the first 4k superblock area of node 1 from being updated. This bug can lead to hangs during mdadm/clustermd_tests/01r1_Grow_resize operations, potentially disrupting RAID functionality and data integrity.
How To Fix
Minimum fixed version
6.12.48-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as possible to mitigate the risk.
Conclusion
The identified vulnerability in the Linux kernel's md/md-bitmap subsystem poses a significant risk to systems utilizing RAID configurations. It is crucial for users to update their systems to the patched versions to ensure continued stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves an incorrect calculation of the bitmap limit in the clustermd subsystem of the Linux kernel, which can lead to hangs during specific RAID operations.
If exploited, this vulnerability can cause hangs in RAID operations, potentially leading to system instability and data access issues.
If you are using Debian 13 or 14 with the affected versions of the Linux kernel, your system may be vulnerable. You can check for vulnerabilities using Vulert's playground at Vulert Scanner.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to avoid potential disruptions.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-22124.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
