CVE-2025-38621

What it actually does

NULL pointer dereference in rdev_addable() when called under RCU read lock from md_start_sync() because rdev->mddev can be set to NULL before synchronize_rcu completes in md_kick_rdev_from_array.

Why it matters to the business

Linux systems using software RAID (md) may suffer kernel panics during array synchronization, resulting in unexpected crashes, service disruption, and operational downtime; prevalence in container and server environments heightens exposure.

How an attack unfolds

An attacker with local privileges triggers concurrent md device removal and sync operations (md_spares_need_change path) to hit the unprotected rdev->mddev dereference in RCU context, as observed in container-optimized OS privilege escalation attempts by listed threat actors.

How to fix it

Upgrade the Linux kernel to commit b5fbe940862339cdcc34dea7a057ad18d18fa137; for listed Chainguard packages apply version 0.53.0-r0 or newer.

How to confirm the fix worked

Confirm presence of the fix commit in the running kernel source; reproduce md array sync and removal workloads without triggering the NULL dereference oops.

Typical attack path

1. Gain local access on a system with md/raid configured
2. Initiate array modifications that invoke md_kick_rdev_from_array
3. Trigger md_start_sync concurrently to race the RCU-protected rdev_addable call
4. Cause NULL dereference leading to panic

How to detect it

Search kernel logs and oops reports for the exact panic strings and call traces involving rdev_addable under md_start_sync; correlate with container or local workload activity matching listed threat actor patterns.

• rdev_addable+0x4d/0xf0
• md_start_sync+0x329/0x480
• BUG: kernel NULL pointer dereference, address: 00000000000000e0
• Workqueue: md_misc md_start_sync
• CR2: 00000000000000e0

What your security team should do

• Prioritize kernel upgrades on all md/raid hosts given 431 days since publication
• Restrict untrusted local access to systems using Linux software RAID
• Monitor kernel logs for rdev_addable and md_start_sync crashes
• Test fixed kernels in staging before broad deployment