LiveActive security incident?Get immediate response
CVE Record

CVE-2025-22125: md/raid1,raid10: don't ignore IO flags

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: don't ignore IO flags If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced. Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks. Fix those problems by keep IO flags from master bio. Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT")

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's Takeunknown

Analyst readout for executives and security teams

Plain-English summary

CVE-2025-22125 is a Linux kernel md RAID1/RAID10 bug where important storage I/O flags were lost. The described impact is degraded write performance and incorrect I/O behavior, not remote compromise. The source bundle does not show active exploitation, a CVSS score, or a confirmed data-loss condition.

Executive priority

Treat as a targeted infrastructure maintenance item, not an emergency internet-facing risk based on available evidence. Prioritize storage-heavy Linux servers where RAID latency or nowait behavior affects service reliability.

Technical view

md RAID1/RAID10 did not preserve master bio I/O flags. Losing REQ_IDLE caused blk-wbt throttling; losing REQ_META could create metadata priority inversion; losing REQ_NOWAIT changed nonblocking behavior into waiting. The kernel stable fixes keep I/O flags from the master bio.

Likely exposure

Exposure is limited to Linux systems using md RAID1 or RAID10, especially where blk-wbt, filesystem metadata prioritization, or nowait I/O behavior matters. The bundle lists Linux kernel versions as affected but does not provide distribution-specific package status.

Exploitation context

No active exploitation is cited, and KEV is false in the supplied bundle. The issue appears to be an operational correctness and performance flaw in kernel storage handling rather than a directly weaponized vulnerability.

Researcher notes

The record lacks CVSS, CWE, distribution package mapping, and exploit evidence. Analysis should focus on md RAID1/RAID10 bio flag propagation and whether local workloads depend on REQ_IDLE, REQ_META, or REQ_NOWAIT semantics.

Mitigation direction

  • Check vendor or distribution kernel advisories for CVE-2025-22125 fixes.
  • Prioritize systems using Linux md RAID1 or RAID10 storage arrays.
  • Plan kernel updates that include the referenced stable commits.
  • Avoid inventing workarounds; use vendor guidance if patching is delayed.

Validation and detection

  • Inventory Linux hosts using md RAID1 or RAID10.
  • Map running kernel versions to vendor advisories or fixed stable commits.
  • Review storage telemetry for unusual RAID write throttling or latency.
  • Confirm patched kernels preserve normal workload behavior after update.
Prepared
Confidence
medium
Sources
6

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-22125 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5404bc7a87b9949cf61e0174b21f80e73239ab25, 5404bc7a87b9949cf61e0174b21f80e73239ab25, 5404bc7a87b9949cf61e0174b21f80e73239ab25, 5404bc7a87b9949cf61e0174b21f80e73239ab25unaffected
LinuxLinux2.6.19, 0, 6.6.136, 6.12.46, 6.14.2, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.