CVE-2025-22125

What it actually does

The flaw causes md/raid1 and raid10 to discard master bio flags including REQ_IDLE, REQ_META, and REQ_NOWAIT when submitting IO to underlying devices, resulting in unintended throttling by blk-wbt, priority inversion, and forced blocking instead of immediate failure or correct handling.

Why it matters to the business

Write performance on RAID arrays degrades significantly under default blk-wbt settings, leading to slower storage operations and potential availability issues on affected Linux systems without raising direct data loss or confidentiality risks.

How an attack unfolds

An attacker with local access triggers repeated write operations on a RAID1 or RAID10 array while blk-wbt is active; the ignored flags cause all IO to be throttled or delayed at the device level, amplifying resource contention and producing a denial-of-service condition through sustained performance degradation.

How to fix it

Update the Linux kernel to a version containing commit 73506e581c0b1814cdfd2229d589f30751d7de26 or later; for listed Red Hat packages apply the exact fixed versions such as git 0:2.18.4-4.el8_2 and equivalents across all affected git components.

How to confirm the fix worked

Confirm the running kernel contains the fix commit, verify that IO flags are preserved from the master bio in raid1/raid10 submit_bio paths, and test write performance under blk-wbt load to ensure throttling behaves as expected.

Typical attack path

1. Obtain local user access on a system using md/raid1 or raid10
2. Enable or rely on default blk-wbt settings on underlying disks
3. Issue sustained write workloads that set REQ_IDLE, REQ_META, or REQ_NOWAIT flags
4. Observe throttling and blocking behavior at the device queue due to cleared flags
5. Sustain load to maintain degraded availability

How to detect it

Review kernel logs and block layer traces for unexpected throttling on RAID devices, correlate with high-latency write IO patterns, and inspect bio flag handling in md raid1/raid10 code paths for signs of prior exploitation attempts.

What your security team should do

• Apply the kernel patch or fixed package versions immediately given the 560-day publication window
• Audit systems using md RAID for blk-wbt configuration and performance baselines
• Monitor EPSS and threat actor activity on related kernel CVEs for potential combined exploitation
• Test the update in a staging environment before broad deployment to avoid storage regressions