---
id: CVE-2025-68373
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md: avoid repeated calls to del_gendisk

  There is a uaf problem which is found by case 23rdev-lifetime:

  Oops: general protection fault, probably for non-canonical addr…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md: avoid repeated calls to del_gendisk

  There is a uaf problem which is found by case 23rdev-lifetime:

  Oops: general protection fault, probably for non-canonical addr…
severity: none
published: '2025-12-24'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68373'
references:
  - url: 'https://git.kernel.org/stable/c/90e3bb44c0a86e245d8e5c6520206fa113acb1ee'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b4c5cf406062ad44cd178269571530c6435b2f3b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f0fae1debeb9102398ddf2ef69b4f5d395afafed'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00186
epssPercentile: 0.0754
ingestedAt: '2026-10-13T11:23:51.154Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

md: avoid repeated calls to del_gendisk

There is a uaf problem which is found by case 23rdev-lifetime:

Oops: general protection fault, probably for non-canonical address 0xdead000000000122
RIP: 0010:bdi_unregister+0x4b/0x170
Call Trace:
 <TASK>
 __del_gendisk+0x356/0x3e0
 mddev_unlock+0x351/0x360
 rdev_attr_store+0x217/0x280
 kernfs_fop_write_iter+0x14a/0x210
 vfs_write+0x29e/0x550
 ksys_write+0x74/0xf0
 do_syscall_64+0xbb/0x380
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff5250a177e

The sequence is:
1. rdev remove path gets reconfig_mutex
2. rdev remove path release reconfig_mutex in mddev_unlock
3. md stop calls do_md_stop and sets MD_DELETED
4. rdev remove path calls del_gendisk because MD_DELETED is set
5. md stop path release reconfig_mutex and calls del_gendisk again

So there is a race condition we should resolve. This patch adds a
flag MD_DO_DELETE to avoid the race condition.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.