CVE-2025-38451

What it actually does

Missing super-block existence check for external bitmaps in bitmap_get_stats() causes dereference of an invalid pointer (non-canonical address), resulting in a general protection fault and kernel oops during seq_read on procfs stats.

Why it matters to the business

Leads to system crashes and denial of service on Linux servers or devices using md RAID with external bitmaps; widespread kernel exposure increases operational risk across servers, embedded systems, and distributions, though low EPSS and no KEV status indicate limited active exploitation pressure.

How an attack unfolds

A local attacker with unprivileged access reads the bitmap statistics file (via /proc or seq_read paths) on a system configured with an external bitmap lacking a super-block; this triggers the unchecked pointer access and crashes the kernel. Threat actor mentions of Linux kernel privilege escalation campaigns highlight related kernel attack interest but this flaw yields only availability impact.

How to fix it

Upgrade the Linux kernel to 6.1.146 or apply commit a23b16ba3274961494f5ad236345d238364349ff; for affected Debian packages update webkit2gtk/wpewebkit to 2.48.5-1 or the corresponding backports 2.48.5-1~deb12u1 / 2.48.5-1~deb13u1.

How to confirm the fix worked

Verify running kernel version is at or above the listed fixed releases, confirm the patch commit is present in the source tree, and test that bitmap_get_stats no longer oopses on external bitmap configurations.

Typical attack path

1. Obtain local user or process access on an affected Linux system
2. Configure or encounter an md device using an external bitmap without super-block storage
3. Trigger bitmap stats collection through procfs read or seq_read_iter
4. Cause kernel GPF and system instability or reboot

How to detect it

Search kernel logs and dmesg for oops messages containing bitmap_get_stats and RIP references to that function; inspect /proc/mdstat or bitmap-related procfs entries on systems with external bitmaps; correlate with threat actor activity around Linux kernel privilege escalation campaigns.

• bitmap_get_stats+0x45/0xd0
• Oops: GPF, probably for non-canonical address
• seq_read_iter.*bitmap_get_stats

What your security team should do

• Apply kernel updates to 6.1.146 or patched commit within standard change windows given moderate CVSS and low EPSS
• Audit systems for md RAID configurations using external bitmaps
• Monitor kernel logs for bitmap-related oopses as an interim detection measure
• Track EPSS trend for any future increase that may warrant expedited patching