CVE-2025-68374: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68374 is a use-after-free vulnerability in the Linux kernel's md (multiple device/software RAID) subsystem, specifically in the md_wakeup_thread() function. The flaw arises from improper RCU (Read-Copy-Update) pointer protection: the thread pointer is dereferenced and passed to md_wakeup_thread() before rcu_read_lock() is acquired, rendering the RCU protection ineffective. This affects Linux kernel versions prior to the fixes backported into stable releases (6.12.63, 6.17.13, 6.18.2, and 6.19-rc1). It was disclosed on December 24, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as a use-after-free (CWE-416) resulting from incorrect RCU locking discipline in the Linux kernel's md subsystem. In the vulnerable code path, the thread RCU-protected pointer is read and its value passed directly to md_wakeup_thread() without first holding rcu_read_lock(), meaning the pointer could be freed by another CPU between the read and its use. The attack vector is local, requiring low privileges, and exploitation would involve triggering the race condition in the md subsystem's thread wakeup path. No public proof-of-concept exploit code has been identified (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation of this vulnerability by a low-privileged local attacker could cause system instability or a kernel crash, resulting in a denial of service condition. The primary impact is on availability (rated High), with no direct confidentiality or integrity impact identified. Affected systems include any Linux host running a vulnerable kernel version with the md (software RAID) subsystem active (Red Hat Advisory, Red Hat Bugzilla).

Apply the latest Linux kernel patches from your distribution vendor. Fixed versions include Linux kernel 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1, with upstream patches available via the stable kernel tree. Ubuntu has issued security notices USN-8179-1 through USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, and USN-8265-1 addressing this CVE. As a workaround, restrict local user access on systems using software RAID (md) to minimize potential exploit opportunities, and monitor for unusual kernel-related activity (Red Hat Advisory, Red Hat Bugzilla).