CVE-2025-22126

What it actually does

Use-after-free in Linux kernel MD subsystem during list iteration over all_mddevs in md_notify_reboot() and md_exit() due to unsafe list_for_each_entry_safe allowing concurrent deletion and kfree of next mddev entry.

Why it matters to the business

Potential kernel crashes, data corruption or local privilege escalation on affected Linux systems; high ecosystem prevalence with 599 downstream dependents increases exposure across Red Hat Enterprise Linux 8 Python package ecosystem.

How an attack unfolds

Attacker triggers concurrent MD device removal while md_notify_reboot or md_exit iterates the list, racing deletion and free of the next mddev so that continued dereference after mddev_put causes UAF; threat actors have demonstrated similar Linux kernel privilege escalation patterns in related CVEs.

How to fix it

Update to fixed package versions: python-PyMySQL 0:0.10.1-2.module+el8.10.0+20784+edafcd43, python-docs 0:3.6.7-2.module+el8.10.0+20784+edafcd43, python-docutils 0:0.14-12.module+el8.10.0+20784+edafcd43 and equivalent fixed builds for all other listed Python packages on Red Hat Enterprise Linux 8.

How to confirm the fix worked

Verify package versions match the listed fixed releases; confirm kernel MD list iteration logic uses safe reference counting or list_for_each_entry pattern without UAF window.

Typical attack path

1. Obtain local access on target system
2. Create or manipulate MD devices to set up list state
3. Trigger md_notify_reboot or kernel module exit path
4. Race deletion of next mddev entry to induce UAF dereference
5. Leverage freed object for memory corruption or escalation

How to detect it

Review kernel logs and audit records for MD device removal events coinciding with reboot or module unload; look for use-after-free warnings or crashes referencing mddev structures.

What your security team should do

• Prioritize patching all listed Python packages to the exact fixed module versions provided
• Monitor for kernel updates addressing MD UAF in future releases
• Restrict local user access on systems using MD devices until remediated