CVE-2025-68368: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68368 is a NULL pointer dereference vulnerability in the Linux kernel's MD (Multiple Devices/software RAID) subsystem. The flaw arises because the bioset structure is not initialized in mddev_init(), causing a kernel panic when IO operations (such as metadata updates via sysfs) are triggered before md_run() is called. Affected versions include Linux kernel builds from commit d981ed8419303ed12351eea8541ad6cb76455fe3 up to (but not including) the patched commits, with fixes landing in Linux 6.18.2 and 6.19-rc1. The vulnerability was published on December 24, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.018% (Feedly, EUVD).

The root cause is a missing initialization of the bioset member in mddev_init() (CWE-476: NULL Pointer Dereference). When a user writes to a sysfs attribute (e.g., new_level) on an inactive MD array before md_run() is invoked, the kernel attempts to perform IO via md_update_sb(), which dereferences the uninitialized bioset pointer, triggering a kernel NULL pointer dereference at address 0x0000000000000020. The call trace proceeds through md_update_sb → new_level_store → md_attr_store → sysfs_kf_write → kernfs_fop_write_iter → vfs_write. A minimal reproducer involves creating an MD RAID1 array, setting it to inactive state, and then writing a new RAID level via sysfs (Feedly).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic (BUG) and system crash, directly impacting availability. Because this is a local denial-of-service condition triggered through sysfs writes, it does not directly expose confidential data or allow code execution in typical configurations. The impact is limited to systems where unprivileged or low-privileged local users have write access to MD array sysfs attributes (Feedly, EUVD).

No public exploit code or weaponized proof-of-concept has been identified for CVE-2025-68368. The vulnerability requires local access to the system and the ability to write to sysfs MD array attributes, limiting its attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no evidence of in-the-wild exploitation. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term (Feedly).

1. Local Access: Obtain local access to a Linux system running a vulnerable kernel version with the MD subsystem enabled.
2. Create MD Array: Use mdadm to create a RAID1 array: mdadm -CR /dev/md0 -l1 -n2 /dev/sdc /dev/sdd.
3. Set Array Inactive: Write inactive to the array state sysfs attribute: echo inactive > /sys/block/md0/md/array_state.
4. Trigger Sysfs Write: Write a new RAID level to the sysfs attribute before md_run() is called: echo 10 > /sys/block/md0/md/new_level.
5. Kernel Panic: The kernel attempts to call md_update_sb(), dereferences the uninitialized bioset pointer, and triggers a NULL pointer dereference, crashing the system (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: kernel NULL pointer dereference, address: 0000000000000020 with a call trace including md_update_sb, new_level_store, md_attr_store, and sysfs_kf_write.
• System Behavior: Unexpected system crash or kernel panic on systems using Linux software RAID (MD) arrays.
• Process/Audit Logs: Audit logs recording writes to /sys/block/md*/md/new_level or /sys/block/md*/md/array_state by local users, particularly setting state to inactive followed by a level change.

The fix has been merged into the Linux kernel stable tree: patch commit 9d37fe37dfa0833a8768740f0575e0ffd793cb4a (for the 6.12.x stable branch) and 381a3ce1c0ffed647c9b913e142b099c7e9d5afc. The fix is included in Linux 6.18.2 and 6.19-rc1. Ubuntu has issued security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 addressing this vulnerability. Administrators should update to a patched kernel version; as a temporary workaround, restricting local user write access to MD sysfs attributes (e.g., via file permissions or SELinux/AppArmor policies) can reduce exposure (Ubuntu USN-8177-1, Ubuntu USN-8183-1, Ubuntu USN-8245-1).