CVE-2025-71135

A NULL pointer dereference vulnerability was found in the Linux kernel's RAID5 implementation. In raid5_store_group_thread_cnt(), when mddev->private (conf) is NULL, the function still calls raid5_quiesce() which re-reads mddev->private and dereferences it. This causes a kernel crash when accessing conf->quiesce or calling wake_up() on the NULL pointer's wait queue.

This vulnerability affects systems using software RAID5 arrays. The NULL dereference can be triggered through sysfs by writing to the group_thread_cnt attribute when the RAID array is in a transitional state where the private configuration is not yet initialized. Root privileges are required to write to RAID sysfs attributes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.