CVE-2025-22124

What it actually does

Incorrect bitmap_limit calculation in md-bitmap for clustermd when pg_index equals storage.file_pages causes md_super_write to be invoked with zero size, leaving the first 4k superblock area unupdated via filemap_write_page.

Why it matters to the business

Clustered storage configurations using MD RAID may experience hangs or stalled operations during superblock writes, leading to degraded availability and reliability for multi-node storage setups; widespread kernel exposure increases operational risk across Linux environments.

How an attack unfolds

An attacker with local access to a clustermd node triggers the boundary condition during superblock write operations; the zero-size write prevents necessary metadata updates, resulting in hangs that disrupt cluster functionality.

How to fix it

Apply kernel updates that incorporate the fix using (pg_index % bitmap->storage.file_pages) for bitmap_limit; for listed Red Hat packages upgrade to the specified fixed versions such as php 0:7.4.33-2.module+el8.10.0+22485+a3539972 and libzip 0:1.6.1-1.module+el8.10.0+22485+a3539972.

How to confirm the fix worked

Confirm updated kernel or package versions are installed, reproduce the clustermd superblock write scenario, and verify that bitmap_limit is correctly computed without zero-size writes.

Typical attack path

1. Obtain local access on a system running clustermd
2. Trigger bitmap superblock write path in md-bitmap code
3. Force pg_index to equal file_pages value
4. Cause md_super_write call with zero length
5. Induce hang in dependent cluster operations or tests

How to detect it

Review kernel and md logs for repeated superblock write failures or zero-length operations; inspect clustermd test hangs and bitmap storage calculations around file_pages boundaries.

What your security team should do

• Prioritize patching kernel and affected packages on all clustermd systems due to storage reliability impact
• Monitor for md-related hangs in cluster logs
• Test clustermd resize and superblock operations post-update