Log in Start free

Vulnerability · Published Dec 24, 2025 · Assigned by Linux

CVE-2025-68368md: init bioset in mddev_init

Unrated

In plain English

A security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 88.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: md: init bioset in mddev_init IO operations may be needed before md_run(), such as updating metadata after writing sysfs. Without bioset, this triggers a NULL pointer dereference as below: BUG: kernel NULL pointer dereference, address: 0000000000000020 Call Trace: md_update_sb+0x658/0xe00 new_level_store+0xc5/0x120 md_attr_store+0xc9/0x1e0 sysfs_kf_write+0x6f/0xa0 kernfs_fop_write_iter+0x141/0x2a0 vfs_write+0x1fc/0x5a0 ksys_write+0x79/0x180 __x64_sys_write+0x1d/0x30 x64_sys_call+0x2818/0x2880 do_syscall_64+0xa9/0x580 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Reproducer ``` mdadm -CR /dev/md0 -l1 -n2 /dev/sd[cd] echo inactive > /sys/block/md0/md/array_state echo 10 > /sys/block/md0/md/new_level ``` mddev_init() can only be called once per mddev, no need to test if bioset has been initialized anymore.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.115-2DEBIAN-CVE-2025-68368
Debian:14linux6.18.3-1DEBIAN-CVE-2025-68368
Ubuntu:25.10linux6.17.0-22.22UBUNTU-CVE-2025-68368
Ubuntu:25.10linux6.17.0-22.22USN-8177-1
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-68368
Ubuntu:25.10linux-aws6.17.0-1012.12UBUNTU-CVE-2025-68368
Ubuntu:25.10linux-aws6.17.0-1012.12USN-8183-2
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-aws-6.176.17.0-1012.12~24.04.1USN-8183-2
Ubuntu:24.04:LTSlinux-aws-6.176.17.0-1012.12~24.04.1UBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-68368
Ubuntu:25.10linux-azure6.17.0-1013.13UBUNTU-CVE-2025-68368
Ubuntu:25.10linux-azure6.17.0-1013.13USN-8245-1
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-azure-6.176.17.0-1013.13~24.04.1USN-8245-1
Ubuntu:24.04:LTSlinux-azure-6.176.17.0-1013.13~24.04.1UBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-68368
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2025-68368
Ubuntu:25.10linux-gcp6.17.0-1012.12UBUNTU-CVE-2025-68368
Ubuntu:25.10linux-gcp6.17.0-1012.12USN-8183-1
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1012.12~24.04.1UBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1012.12~24.04.1USN-8183-1
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-hwe-6.176.17.0-22.22~24.04.1USN-8183-2
Ubuntu:24.04:LTSlinux-hwe-6.176.17.0-22.22~24.04.1UBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-nvidia-6.176.17.0-1018.18UBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1020.20UBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1020.20USN-8245-1
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2025-68368
Ubuntu:25.10linux-oracle6.17.0-1011.11USN-8183-2
Ubuntu:25.10linux-oracle6.17.0-1011.11UBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1011.11~24.04.1UBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1011.11~24.04.1USN-8183-2
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-68368
Ubuntu:25.10linux-raspi6.17.0-1013.13UBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-68368
Ubuntu:25.10linux-realtime6.17.0-1010.11UBUNTU-CVE-2025-68368
Ubuntu:25.10linux-realtime6.17.0-1010.11USN-8177-1
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-68368
Ubuntu:25.10linux-riscv6.17.0-22.22.1UBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2025-68368
Ubuntu:24.04:LTSlinux-riscv-6.176.17.0-22.22.1~24.04.1UBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-68368
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-68368

Affected products (as reported)

VendorProductVersions
Linux Linux d981ed8419303ed12351eea8541ad6cb76455fe3 – before 903fb4851ee8d291372d285f616c398a9c4cbbecd981ed8419303ed12351eea8541ad6cb76455fe3 – before 9d37fe37dfa0833a8768740f0575e0ffd793cb4ad981ed8419303ed12351eea8541ad6cb76455fe3 – before 381a3ce1c0ffed647c9b913e142b099c7e9d5afc
Linux Linux 6.12

References