CVE-2025-71225

A race condition flaw was found in the Linux kernel's MD RAID1 driver. When updating the raid_disks count via sysfs during concurrent I/O errors, the freeze_array() function may return before all queued r1bio structures are released. This can cause free_r1bio() to access memory out of bounds and potentially corrupt the memory pool when r1bios allocated with the old raid_disks value are freed to the resized mempool.

Exploiting this flaw requires concurrent I/O errors during a RAID1 reshape operation initiated through sysfs. While the race window exists, triggering it reliably in a production environment would be challenging without control over disk I/O error injection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.