Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2025-38445
CVE-2025-38445:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2025-38445 is a vulnerability discovered in the Linux kernel affecting the md/raid1 subsystem. The vulnerability was disclosed on July 25, 2025, and involves a stack memory use-after-return issue in the raid1_reshape function (NVD).
Technical details
The vulnerability occurs in the raid1reshape function where newpool is allocated on the stack and assigned to conf->r1biopool. This assignment results in conf->r1biopool.wait.head pointing to a stack address. When this address is accessed later through functions like raid1readrequest or raid1writerequest, it can lead to a kernel panic. The issue manifests specifically when mempoolalloc fails and attempts to access the invalid stack address through wake_up(&pool->wait) (NVD).
Impact
When exploited, this vulnerability can cause a kernel panic in the Linux operating system, potentially leading to system crashes and denial of service conditions (NVD).
Mitigation and workarounds
A fix has been implemented that involves reinitializing conf->r1bio_pool.wait after assigning newpool, preventing the use-after-return condition (NVD).
Additional resources
Source: This report was generated using AI
Related Linux Kernel vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management