CVE-2025-68373: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68373 is a use-after-free (UAF) race condition vulnerability in the Linux kernel's MD (Multiple Device/software RAID) subsystem, caused by repeated calls to del_gendisk during concurrent device removal and stop operations. It was disclosed on December 24, 2025, and affects Linux kernel versions from commit 9e59d609763f up to the patched commits in stable branches. Fixed versions include Linux 6.17.13, 6.18.2, and 6.19-rc1. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access with low privileges (Red Hat CVE, Red Hat Bugzilla).

The root cause is a race condition (CWE-362) combined with a use-after-free (CWE-416) in the Linux kernel's MD subsystem. The flaw arises when the rdev remove path and the md stop path both attempt to call del_gendisk on the same device concurrently: the rdev remove path releases reconfig_mutex via mddev_unlock, at which point md stop sets MD_DELETED and calls del_gendisk; the rdev path then also calls del_gendisk because it observes MD_DELETED, resulting in a double invocation on an already-freed object. This triggers a general protection fault at bdi_unregister+0x4b/0x170 as observed in the kernel oops trace. The fix introduces a new MD_DO_DELETE flag to serialize disk deletion and prevent the double-free scenario (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes a kernel general protection fault, leading to system instability or a denial-of-service (system crash). The vulnerability has no confidentiality or integrity impact; the sole consequence is high availability impact, as a local low-privileged user can crash the kernel on systems using software RAID (MD) devices. There is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Red Hat CVE, Red Hat Bugzilla).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing general protection fault at bdi_unregister+0x4b/0x170, with a call trace through __del_gendisk, mddev_unlock, rdev_attr_store, and kernfs_fop_write_iter.
• Logs: Non-canonical address references such as 0xdead000000000122 in kernel crash output, which is a hallmark of use-after-free conditions in the Linux kernel.
• Process: Unexpected system reboots or kernel panics on hosts running software RAID (MD) arrays, particularly during concurrent device removal and array stop operations.

Update the Linux kernel to a patched version: 6.17.13, 6.18.2, or 6.19-rc1 and later, which include the MD_DO_DELETE flag fix. The upstream patches are available at the stable kernel git repository (commits b4c5cf406062, f0fae1debeb9, and 90e3bb44c0a8). As a temporary workaround, restrict local user access to MD/RAID device management interfaces and avoid concurrent device removal and array stop operations. Apply vendor-specific kernel updates as they become available from distributions such as Red Hat (Red Hat CVE, Red Hat Bugzilla).