CVE-2025-23131

What it actually does

Positive return value from do_uevent causes new_lockspace to leave lockspace unset while __dlm_new_lockspace treats it as success, allowing device_create_lockspace to pass NULL to dlm_find_lockspace_local and trigger a NULL pointer dereference.

Why it matters to the business

Systems using DLM for cluster locking may experience unexpected crashes or denial of service; the large number of downstream Ruby package dependents on RHEL increases exposure surface across enterprise deployments.

How an attack unfolds

An attacker triggers a positive value write to event_done during lockspace creation; the inconsistent success handling leaves a NULL lockspace that is later dereferenced, resulting in a kernel crash that can be chained with other kernel issues for privilege escalation as seen in related campaigns.

How to fix it

Update all listed Ruby packages on RHEL EUS 9.2 to the fixed versions (e.g., ruby 3.0.4-161.el9_2.2, rubygem-bundler 2.2.33-161.el9_2.2 and equivalents for each package); apply kernel updates containing the dlm fix when available.

How to confirm the fix worked

Verify package versions match the fixed releases, confirm absence of the vulnerable do_uevent / new_lockspace logic in source, and test lockspace creation paths under positive return conditions.

Typical attack path

1. Trigger dlm lockspace creation path that returns positive value from do_uevent
2. Force new_lockspace to undo work without setting lockspace
3. Call device_create_lockspace with resulting NULL lockspace
4. Invoke dlm_find_lockspace_local on the NULL pointer to cause dereference

How to detect it

Inspect kernel logs for NULL pointer dereference messages originating from dlm_find_lockspace_local or device_create_lockspace; correlate with lockspace creation events and watch for patterns matching related privilege-escalation campaigns.

What your security team should do

• Prioritize patching all affected Ruby packages on RHEL EUS 9.2 within the next maintenance window
• Monitor for related kernel privilege-escalation activity from the listed threat actors
• Review DLM usage in clustered applications and isolate high-value systems until patched