CVE-2025-68374

What it actually does

Improper RCU usage in md_wakeup_thread allows the thread pointer to be dereferenced outside an RCU read-side critical section, resulting in a use-after-free condition on the md thread structure.

Why it matters to the business

Linux systems performing software RAID or md storage operations face elevated risk of kernel crashes or memory corruption that can lead to downtime or potential local privilege escalation, particularly on servers with high storage subsystem activity.

How an attack unfolds

An attacker with local access manipulates md devices to trigger wakeup paths; because the pointer is passed without holding the RCU lock, concurrent freeing of the thread structure allows the attacker to reuse the dangling pointer for arbitrary kernel memory access or denial of service.

How to fix it

Apply the upstream fix in commit 21989cb5034c835b212385a2afadf279d8069da0; rebuild and deploy kernels containing this change. Reboot systems after installation.

How to confirm the fix worked

Verify the presence of commit 21989cb5034c835b212385a2afadf279d8069da0 in the running kernel source or confirm the kernel version incorporates the md RCU fix; test md device creation and wakeup under load to ensure stability.

Typical attack path

1. Gain local user access on an affected Linux system
2. Create or modify md/RAID devices to exercise wakeup paths
3. Race the thread pointer dereference against its RCU-protected lifetime
4. Leverage the resulting use-after-free for code execution or crash

How to detect it

Monitor kernel logs and crash dumps for references to md_wakeup_thread, RCU stalls, or use-after-free warnings in the md subsystem; correlate with processes performing RAID configuration changes.

What your security team should do

• Patch kernels to the fixed commit on all md-using systems within standard change windows
• Prioritize servers handling production storage workloads
• Review md device usage and consider hardware RAID alternatives where feasible