CVE-2025-68368: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68368 is a NULL pointer dereference vulnerability in the Linux kernel's MD (Multiple Devices/software RAID) subsystem. The flaw arises because the bioset structure is not initialized in mddev_init(), causing a kernel panic when IO operations (such as metadata updates via sysfs) are triggered before md_run() is called. Affected versions include Linux kernel builds from commit d981ed8419303ed12351eea8541ad6cb76455fe3 up to (but not including) the patched commits, with fixes landing in Linux 6.18.2 and 6.19-rc1. The vulnerability was published on December 24, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.018% (Feedly, EUVD).

The root cause is a missing initialization of the bioset member in mddev_init() (CWE-476: NULL Pointer Dereference). When a user writes to a sysfs attribute (e.g., new_level) on an inactive MD array before md_run() is invoked, the kernel attempts to perform IO via md_update_sb(), which dereferences the uninitialized bioset pointer, triggering a kernel NULL pointer dereference at address 0x0000000000000020. The call trace proceeds through md_update_sb → new_level_store → md_attr_store → sysfs_kf_write → kernfs_fop_write_iter → vfs_write. A minimal reproducer involves creating an MD RAID1 array, setting it to inactive state, and then writing a new RAID level via sysfs (Feedly).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic (BUG) and system crash, directly impacting availability. Because this is a local denial-of-service condition triggered through sysfs writes, it does not directly expose confidential data or allow code execution in typical configurations. The impact is limited to systems where unprivileged or low-privileged local users have write access to MD array sysfs attributes (Feedly, EUVD).

1. Local Access: Obtain local access to a Linux system running a vulnerable kernel version with the MD subsystem enabled.
2. Create MD Array: Use mdadm to create a RAID1 array: mdadm -CR /dev/md0 -l1 -n2 /dev/sdc /dev/sdd.
3. Set Array Inactive: Write inactive to the array state sysfs attribute: echo inactive > /sys/block/md0/md/array_state.
4. Trigger Sysfs Write: Write a new RAID level to the sysfs attribute before md_run() is called: echo 10 > /sys/block/md0/md/new_level.
5. Kernel Panic: The kernel attempts to call md_update_sb(), dereferences the uninitialized bioset pointer, and triggers a NULL pointer dereference, crashing the system (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: kernel NULL pointer dereference, address: 0000000000000020 with a call trace including md_update_sb, new_level_store, md_attr_store, and sysfs_kf_write.
• System Behavior: Unexpected system crash or kernel panic on systems using Linux software RAID (MD) arrays.
• Process/Audit Logs: Audit logs recording writes to /sys/block/md*/md/new_level or /sys/block/md*/md/array_state by local users, particularly setting state to inactive followed by a level change.

The fix has been merged into the Linux kernel stable tree: patch commit 9d37fe37dfa0833a8768740f0575e0ffd793cb4a (for the 6.12.x stable branch) and 381a3ce1c0ffed647c9b913e142b099c7e9d5afc. The fix is included in Linux 6.18.2 and 6.19-rc1. Ubuntu has issued security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 addressing this vulnerability. Administrators should update to a patched kernel version; as a temporary workaround, restricting local user write access to MD sysfs attributes (e.g., via file permissions or SELinux/AppArmor policies) can reduce exposure (Ubuntu USN-8177-1, Ubuntu USN-8183-1, Ubuntu USN-8245-1).