Improper Initialization in Linux kernel md driver



| Updated: 2025-05-11
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2025-21712
CWE-ID CWE-665
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Improper Initialization

EUVDB-ID: #VU105061

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21712

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the md_seq_show() function in drivers/md/md.c, within the bitmap_get_stats() function in drivers/md/md-bitmap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.1 - 6.13.1

CPE2.3 External links

https://git.kernel.org/stable/c/237e19519c8ff6949f0ef57c4a0243f5b2b0fa18
https://git.kernel.org/stable/c/4e9316eee3885bfb311b4759513f2ccf37891c09
https://git.kernel.org/stable/c/8d28d0ddb986f56920ac97ae704cc3340a699a30
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.130
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.13
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.2
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.80


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###