CVE-2025-22124

In the Linux kernel, the following vulnerability has been resolved:

md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb

In clustermd, separate write-intent-bitmaps are used for each cluster node:

0 4k 8k 12k

| idle | md super | bm super [0] + bits | | bm bits[0, contd] | bm super[1] + bits | bm bits[1, contd] | | bm super[2] + bits | bm bits [2, contd] | bm super[3] + bits | | bm bits [3, contd] | | |

So in node 1, pg_index in __write_sb_page() could equal to bitmap->storage.file_pages. Then bitmap_limit will be calculated to 0. md_super_write() will be called with 0 size. That means the first 4k sb area of node 1 will never be updated through filemap_write_page(). This bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize.

Here use (pg_index % bitmap->storage.file_pages) to make calculation of bitmap_limit correct.

This vulnerability is rated with a Moderate severity because it requires elevated administrative privileges to configure clustered software RAID and specifically results in a denial of service through a kernel hang. Red Hat Enterprise Linux deployments are typically unaffected by default since standard storage configurations use non-clustered software RAID or logical volume management without the cluster multi-device subsystem active. Only environments explicitly configured with clustered multi-device arrays are susceptible to this deadlock condition during disk growth or superblock write operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.