CVE-2025-38444 (GCVE-0-2025-38444)
Vulnerability from cvelistv5
Published
2025-07-25 15:27
Modified
2025-07-28 04:22
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: raid10: cleanup memleak at raid10_make_request If raid10_read_request or raid10_write_request registers a new request and the REQ_NOWAIT flag is set, the code does not free the malloc from the mempool. unreferenced object 0xffff8884802c3200 (size 192): comm "fio", pid 9197, jiffies 4298078271 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 88 41 02 00 00 00 00 00 .........A...... 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc c1a049a2): __kmalloc+0x2bb/0x450 mempool_alloc+0x11b/0x320 raid10_make_request+0x19e/0x650 [raid10] md_handle_request+0x3b3/0x9e0 __submit_bio+0x394/0x560 __submit_bio_noacct+0x145/0x530 submit_bio_noacct_nocheck+0x682/0x830 __blkdev_direct_IO_async+0x4dc/0x6b0 blkdev_read_iter+0x1e5/0x3b0 __io_read+0x230/0x1110 io_read+0x13/0x30 io_issue_sqe+0x134/0x1180 io_submit_sqes+0x48c/0xe90 __do_sys_io_uring_enter+0x574/0x8b0 do_syscall_64+0x5c/0xe0 entry_SYSCALL_64_after_hwframe+0x76/0x7e V4: changing backing tree to see if CKI tests will pass. The patch code has not changed between any versions.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/10c6021a609deb95f23f0cc2f89aa9d4bffb14c7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2941155d9a5ae098b480d551f3a5f8605d4f9af5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8fc3d7b23d139e3cbc944c15d99b3cdbed797d2d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9af149ca9d0dab6e59e813519d309eff62499864
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ed7bcd9f617e4107ac0813c516e72e6b8f6029bd
Impacted products
Vendor Product Version
Linux Linux Version: 39db562b3fedb93978a7e42dd216b306740959f8
Version: c9aa889b035fca4598ae985a0f0c76ebbb547ad2
Version: c9aa889b035fca4598ae985a0f0c76ebbb547ad2
Version: c9aa889b035fca4598ae985a0f0c76ebbb547ad2
Version: c9aa889b035fca4598ae985a0f0c76ebbb547ad2
Version: c9aa889b035fca4598ae985a0f0c76ebbb547ad2
 Create a notification for this product.
   Linux Linux Version: 5.17
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10c6021a609deb95f23f0cc2f89aa9d4bffb14c7",
              "status": "affected",
              "version": "39db562b3fedb93978a7e42dd216b306740959f8",
              "versionType": "git"
            },
            {
              "lessThan": "9af149ca9d0dab6e59e813519d309eff62499864",
              "status": "affected",
              "version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
              "versionType": "git"
            },
            {
              "lessThan": "8fc3d7b23d139e3cbc944c15d99b3cdbed797d2d",
              "status": "affected",
              "version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
              "versionType": "git"
            },
            {
              "lessThan": "2941155d9a5ae098b480d551f3a5f8605d4f9af5",
              "status": "affected",
              "version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
              "versionType": "git"
            },
            {
              "lessThan": "ed7bcd9f617e4107ac0813c516e72e6b8f6029bd",
              "status": "affected",
              "version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
              "versionType": "git"
            },
            {
              "lessThan": "43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24",
              "status": "affected",
              "version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "5.15.111",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nraid10: cleanup memleak at raid10_make_request\n\nIf raid10_read_request or raid10_write_request registers a new\nrequest and the REQ_NOWAIT flag is set, the code does not\nfree the malloc from the mempool.\n\nunreferenced object 0xffff8884802c3200 (size 192):\n   comm \"fio\", pid 9197, jiffies 4298078271\n   hex dump (first 32 bytes):\n     00 00 00 00 00 00 00 00 88 41 02 00 00 00 00 00  .........A......\n     08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n   backtrace (crc c1a049a2):\n     __kmalloc+0x2bb/0x450\n     mempool_alloc+0x11b/0x320\n     raid10_make_request+0x19e/0x650 [raid10]\n     md_handle_request+0x3b3/0x9e0\n     __submit_bio+0x394/0x560\n     __submit_bio_noacct+0x145/0x530\n     submit_bio_noacct_nocheck+0x682/0x830\n     __blkdev_direct_IO_async+0x4dc/0x6b0\n     blkdev_read_iter+0x1e5/0x3b0\n     __io_read+0x230/0x1110\n     io_read+0x13/0x30\n     io_issue_sqe+0x134/0x1180\n     io_submit_sqes+0x48c/0xe90\n     __do_sys_io_uring_enter+0x574/0x8b0\n     do_syscall_64+0x5c/0xe0\n     entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nV4: changing backing tree to see if CKI tests will pass.\nThe patch code has not changed between any versions."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:22:27.102Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10c6021a609deb95f23f0cc2f89aa9d4bffb14c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/9af149ca9d0dab6e59e813519d309eff62499864"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fc3d7b23d139e3cbc944c15d99b3cdbed797d2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2941155d9a5ae098b480d551f3a5f8605d4f9af5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed7bcd9f617e4107ac0813c516e72e6b8f6029bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24"
        }
      ],
      "title": "raid10: cleanup memleak at raid10_make_request",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38444",
    "datePublished": "2025-07-25T15:27:27.336Z",
    "dateReserved": "2025-04-16T04:51:24.017Z",
    "dateUpdated": "2025-07-28T04:22:27.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38444\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T16:15:29.860\",\"lastModified\":\"2025-07-29T14:14:55.157\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nraid10: cleanup memleak at raid10_make_request\\n\\nIf raid10_read_request or raid10_write_request registers a new\\nrequest and the REQ_NOWAIT flag is set, the code does not\\nfree the malloc from the mempool.\\n\\nunreferenced object 0xffff8884802c3200 (size 192):\\n   comm \\\"fio\\\", pid 9197, jiffies 4298078271\\n   hex dump (first 32 bytes):\\n     00 00 00 00 00 00 00 00 88 41 02 00 00 00 00 00  .........A......\\n     08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\\n   backtrace (crc c1a049a2):\\n     __kmalloc+0x2bb/0x450\\n     mempool_alloc+0x11b/0x320\\n     raid10_make_request+0x19e/0x650 [raid10]\\n     md_handle_request+0x3b3/0x9e0\\n     __submit_bio+0x394/0x560\\n     __submit_bio_noacct+0x145/0x530\\n     submit_bio_noacct_nocheck+0x682/0x830\\n     __blkdev_direct_IO_async+0x4dc/0x6b0\\n     blkdev_read_iter+0x1e5/0x3b0\\n     __io_read+0x230/0x1110\\n     io_read+0x13/0x30\\n     io_issue_sqe+0x134/0x1180\\n     io_submit_sqes+0x48c/0xe90\\n     __do_sys_io_uring_enter+0x574/0x8b0\\n     do_syscall_64+0x5c/0xe0\\n     entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\nV4: changing backing tree to see if CKI tests will pass.\\nThe patch code has not changed between any versions.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: raid10: limpieza de fuga de memoria en raid10_make_request Si raid10_read_request o raid10_write_request registra una nueva solicitud y el indicador REQ_NOWAIT est\u00e1 configurado, el c\u00f3digo no libera el malloc del grupo de memoria. objeto sin referencia 0xffff8884802c3200 (tama\u00f1o 192): comm \\\"fio\\\", pid 9197, jiffies 4298078271 volcado hexadecimal (primeros 32 bytes): 00 00 00 00 00 00 00 00 88 41 02 00 00 00 00 00 .........A...... 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ seguimiento inverso (crc c1a049a2): __kmalloc+0x2bb/0x450 mempool_alloc+0x11b/0x320 raid10_make_request+0x19e/0x650 [raid10] md_handle_request+0x3b3/0x9e0 __submit_bio+0x394/0x560 __submit_bio_noacct+0x145/0x530 submit_bio_noacct_nocheck+0x682/0x830 __blkdev_direct_IO_async+0x4dc/0x6b0 blkdev_read_iter+0x1e5/0x3b0 __io_read+0x230/0x1110 io_read+0x13/0x30 io_issue_sqe+0x134/0x1180 io_submit_sqes+0x48c/0xe90 __do_sys_io_uring_enter+0x574/0x8b0 do_syscall_64+0x5c/0xe0 entry_SYSCALL_64_after_hwframe+0x76/0x7e V4: Se modific\u00f3 el \u00e1rbol de respaldo para comprobar si las pruebas CKI superan las pruebas. El c\u00f3digo del parche no ha cambiado entre versiones.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/10c6021a609deb95f23f0cc2f89aa9d4bffb14c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2941155d9a5ae098b480d551f3a5f8605d4f9af5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8fc3d7b23d139e3cbc944c15d99b3cdbed797d2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9af149ca9d0dab6e59e813519d309eff62499864\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed7bcd9f617e4107ac0813c516e72e6b8f6029bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.