CVE-2025-38445

What it actually does

Stack-allocated mempool_t newpool assigned to conf->r1bio_pool leaves wait.head pointing to invalid stack memory after function return; subsequent mempool_alloc/free paths invoke wake_up on that address causing kernel panic.

Why it matters to the business

Systems using Linux software RAID1 arrays can experience sudden kernel crashes and reboots during reshape operations, leading to unplanned downtime, potential data unavailability, and operational disruption especially in storage-heavy environments; widespread Linux kernel deployment increases exposure.

How an attack unfolds

An attacker with local access triggers raid1_reshape to initialize the stack-based pool, then forces memory pressure that causes alloc/free operations to dereference the stale wait.head pointer; listed threat actors such as Advanced Spyware Campaign and Linux Kernel Privilege Escalation groups could chain this memory corruption for denial of service or further escalation.

How to fix it

Upgrade to fixed kernel versions: Debian 13 packages 6.12.41-1 or later, Debian 14 packages 6.16.3-1 or later, or mainline commit 4e7c46362550b229354aeb52038f414e231b0037; rebuild and reboot into the patched kernel; avoid manual RAID reshape until updated.

How to confirm the fix worked

Confirm kernel version matches or exceeds listed fixed releases; inspect raid1 code for reinit of conf->r1bio_pool.wait after newpool assignment; run targeted reshape and mempool stress tests in a lab environment to verify absence of panic.

Typical attack path

1. Obtain local code execution on a Linux system with md/raid1 configured
2. Initiate or wait for a reshape operation on the RAID1 array
3. Induce memory allocation pressure to exercise mempool paths
4. Trigger mempool_free when curr_nr falls below min_nr to dereference stack address
5. Cause kernel panic via invalid wake_up on corrupted wait queue

How to detect it

Review kernel logs for sudden panics referencing raid1, mempool, or wake_up after reshape events; correlate with process activity that allocates from r1bio_pool; threat actor names such as Linux Kernel Privilege Escalation in Container-Optimized OS can be used to hunt related campaign indicators in telemetry.

What your security team should do

• Prioritize patching all affected Linux hosts to the specified fixed versions within standard change windows
• Monitor EPSS trend and re-evaluate if score increases beyond 0.01
• Restrict local access and reshape privileges on production storage systems until patched
• Include this class of stack-use-after-return issues in future kernel fuzzing and code-review pipelines