In the Linux kernel, the following vulnerability has been resolved:
md/md-bitmap: fix GPF in bitmapgetstats()
The commit message of commit 6ec1f0239485 ("md/md-bitmap: fix stats collection for external bitmaps") states:
Remove the external bitmap check as the statistics should be
available regardless of bitmap storage location.
Return -EINVAL only for invalid bitmap with no storage (neither in
superblock nor in external file).
But, the code does not adhere to the above, as it does only check for a valid super-block for "internal" bitmaps. Hence, we observe:
Oops: GPF, probably for non-canonical address 0x1cd66f1f40000028 RIP: 0010:bitmapgetstats+0x45/0xd0 Call Trace:
seqreaditer+0x2b9/0x46a seqread+0x12f/0x180 procregread+0x57/0xb0 vfsread+0xf6/0x380 ksysread+0x6d/0xf0 dosyscall64+0x8c/0x1b0 entrySYSCALL64after_hwframe+0x76/0x7e
We fix this by checking the existence of a super-block for both the internal and external case.
[
{
"id": "CVE-2025-38451-2d82e467",
"signature_version": "v1",
"digest": {
"length": 489.0,
"function_hash": "249202065452765382782325550927598213244"
},
"target": {
"file": "drivers/md/md-bitmap.c",
"function": "md_bitmap_get_stats"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d82a729530bd2110ba66e4a1f73461c776edec2"
},
{
"id": "CVE-2025-38451-53585262",
"signature_version": "v1",
"digest": {
"line_hashes": [
"45849734739028646872274464077222441734",
"192363854835643782046384660298785915910",
"283574708006378243085467808911410275605",
"17446924370087184684905864666470754795",
"289583182729404247623234876229306865642"
],
"threshold": 0.9
},
"target": {
"file": "drivers/md/md-bitmap.c"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c17fb542dbd1db745c9feac15617056506dd7195"
},
{
"id": "CVE-2025-38451-78f56af1",
"signature_version": "v1",
"digest": {
"length": 737.0,
"function_hash": "88440872238145660955052330330214823861"
},
"target": {
"file": "drivers/md/md-bitmap.c",
"function": "bitmap_get_stats"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a18f9b08c70e10ea3a897058fee8a4f3b4c146ec"
},
{
"id": "CVE-2025-38451-9fc3dd72",
"signature_version": "v1",
"digest": {
"length": 737.0,
"function_hash": "88440872238145660955052330330214823861"
},
"target": {
"file": "drivers/md/md-bitmap.c",
"function": "bitmap_get_stats"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c17fb542dbd1db745c9feac15617056506dd7195"
},
{
"id": "CVE-2025-38451-abfa5849",
"signature_version": "v1",
"digest": {
"line_hashes": [
"45849734739028646872274464077222441734",
"192363854835643782046384660298785915910",
"283574708006378243085467808911410275605",
"17446924370087184684905864666470754795",
"289583182729404247623234876229306865642"
],
"threshold": 0.9
},
"target": {
"file": "drivers/md/md-bitmap.c"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a18f9b08c70e10ea3a897058fee8a4f3b4c146ec"
},
{
"id": "CVE-2025-38451-c46c2141",
"signature_version": "v1",
"digest": {
"line_hashes": [
"45849734739028646872274464077222441734",
"192363854835643782046384660298785915910",
"283574708006378243085467808911410275605",
"17446924370087184684905864666470754795",
"289583182729404247623234876229306865642"
],
"threshold": 0.9
},
"target": {
"file": "drivers/md/md-bitmap.c"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d82a729530bd2110ba66e4a1f73461c776edec2"
}
]