CVE-2025-71225: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71225 is a race condition vulnerability in the Linux kernel's RAID1 reshape functionality that can lead to out-of-bounds memory access and memory corruption. The flaw exists in the raid1_reshape() function when raid_disks is updated via sysfs, where freeze_array() may unblock prematurely while queued r1bio structures (allocated with the old raid_disks value) are still in use. Affected kernel versions span from 3.10.1 up to (but not including) 6.12.70, and from 6.13 up to (but not including) 6.18.10, as well as release candidates 6.19-rc1 through 6.19-rc3. It was disclosed on February 18, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) in the Linux kernel's MD (Multiple Devices) subsystem. In raid1_reshape(), freeze_array() waits only until nr_sync_pending and (nr_pending - nr_queued) reach zero across all buckets; however, when an I/O error occurs, nr_queued is incremented and the corresponding r1bio is queued to retry_list or bio_end_io_list. This allows freeze_array() to unblock before those r1bios are released, creating a window where conf->raid_disks and the r1bio memory pool (conf->r1bio_pool) are updated while older r1bios — allocated with the previous raid_disks value — remain in flight. When these stale r1bios are subsequently freed, free_r1bio() may access memory out of bounds in put_all_bios() and release r1bios of the wrong size to the new mempool. Exploitation requires local access with low privileges and high attack complexity (concurrent I/O error conditions must be present) (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation can result in out-of-bounds memory access, corruption of mempool management structures, system instability, and potential data corruption on the affected RAID1 array. The primary impact is high availability loss (system crash or RAID degradation) with a low confidentiality impact due to possible exposure of kernel memory contents; integrity is not directly affected. Lateral movement is unlikely given the local attack vector, but data corruption on RAID arrays could have significant operational consequences for storage-dependent workloads (Red Hat Advisory, Red Hat Bugzilla).

Apply the upstream Linux kernel patches that suspend the RAID array during raid_disks updates via sysfs, mirroring the existing protection used by the ioctl SET_ARRAY_INFO path. Fixed versions include kernel 6.12.70 and 6.18.10; downstream distributions including Debian, Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1, USN-8278-2, USN-8296-2, USN-8393-1), SUSE, and Oracle Linux have issued updated packages. As a workaround until patching is possible, restrict sysfs write access to trusted administrators, avoid performing raid_disks updates via sysfs on production RAID1 arrays experiencing I/O errors, and prefer ioctl SET_ARRAY_INFO for such updates (Red Hat Bugzilla, Ubuntu USN-8278-1, git.kernel.org patch).