LiveActive security incident?Get immediate response
CVE Record

CVE-2025-22124: md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb

In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb In clustermd, separate write-intent-bitmaps are used for each cluster node: 0 4k 8k 12k ------------------------------------------------------------------- | idle | md super | bm super [0] + bits | | bm bits[0, contd] | bm super[1] + bits | bm bits[1, contd] | | bm super[2] + bits | bm bits [2, contd] | bm super[3] + bits | | bm bits [3, contd] | | | So in node 1, pg_index in __write_sb_page() could equal to bitmap->storage.file_pages. Then bitmap_limit will be calculated to 0. md_super_write() will be called with 0 size. That means the first 4k sb area of node 1 will never be updated through filemap_write_page(). This bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize. Here use (pg_index % bitmap->storage.file_pages) to make calculation of bitmap_limit correct.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects clustered md RAID bitmap handling. In a specific clustered storage configuration, metadata writes can be calculated with a zero length, leaving part of a node bitmap superblock unwritten and causing grow or resize operations to hang.

Executive priority

Treat this as targeted operational risk for clustered Linux storage, not a broadly proven remote compromise. Patch affected storage nodes through normal kernel maintenance unless clustered md availability is business-critical.

Technical view

In md/md-bitmap for clustermd, per-node write-intent bitmap layout can make pg_index equal bitmap->storage.file_pages. The old calculation sets bitmap_limit to 0, so md_super_write() is called with size 0. The fix uses pg_index modulo file_pages to calculate the correct bitmap_limit.

Likely exposure

Exposure appears limited to Linux systems using md clustered RAID with write-intent bitmaps on affected kernel ranges. General Linux systems not using clustermd or md bitmap grow/resize behavior are less likely to be affected.

Exploitation context

The source bundle does not show active exploitation, KEV listing, CVSS scoring, or a security impact beyond operational hang behavior. The cited kernel description names a hang in mdadm clustermd grow/resize testing.

Researcher notes

The CVE record provides affected version ranges and three stable commit references, but no CVSS, CWE, exploitability assessment, or workaround. Analysis should stay focused on md/md-bitmap clustermd metadata write behavior.

Mitigation direction

  • Check Linux vendor advisories for patched kernel packages containing the referenced fixes.
  • Prioritize updates on hosts using md clustered RAID or clustermd.
  • Avoid assuming a workaround; none is named in the provided sources.
  • Test clustered md grow and resize workflows after applying vendor kernel updates.

Validation and detection

  • Inventory kernels and identify systems using md clustered RAID with write-intent bitmaps.
  • Confirm whether the running kernel includes one of the referenced stable commits or vendor backport.
  • Review mdadm or storage automation logs for clustermd grow/resize hangs.
  • Run vendor-supported regression tests for clustered md maintenance workflows.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-22124 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxab99a87542f194f28e2364a42afbf9fb48b1c724, ab99a87542f194f28e2364a42afbf9fb48b1c724, ab99a87542f194f28e2364a42afbf9fb48b1c724, 655cc01889fa9b65441922565cddee64af49e6d6, 5600d6013c634c2b6b6c6c55c8ecb50c3a6211f2, 6.6.44, 6.10.3unaffected
LinuxLinux6.11, 0, 6.12.46, 6.14.2, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.