{"id":"CVE-2025-71135","title":"md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt()\n\nThe variable mddev->private is first assigned to conf and then checked:\n\n  conf = md…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= be19e6e4339d1579d5f2fae8ce4facf9521dbbfc < 20597b7229aea8b5bc45cd92097640257c7fc33b","Linux >= fa1944bbe6220eb929e2c02e5e8706b908565711 < e5abb6af905de6b2fead8a0b3f32ab0b81468a01","Linux >= fa1944bbe6220eb929e2c02e5e8706b908565711 < 7ad6ef91d8745d04aff9cce7bdbc6320d8e05fe9","Linux >= 6.12.4 < 6.12.64","Linux 6.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:14:32.226190Z"},"published":"2026-01-14","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:23:09.152Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71135","references":[{"url":"https://git.kernel.org/stable/c/20597b7229aea8b5bc45cd92097640257c7fc33b"},{"url":"https://git.kernel.org/stable/c/e5abb6af905de6b2fead8a0b3f32ab0b81468a01"},{"url":"https://git.kernel.org/stable/c/7ad6ef91d8745d04aff9cce7bdbc6320d8e05fe9"}],"tags":["cve.org"],"epss":0.00176,"epssPercentile":0.0711,"ingestedAt":"2026-11-05T22:38:32.051Z","slug":"CVE-2025-71135","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt()\n\nThe variable mddev->private is first assigned to conf and then checked:\n\n  conf = mddev->private;\n  if (!conf) ...\n\nIf conf is NULL, then mddev->private is also NULL. In this case,\nnull-pointer dereferences can occur when calling raid5_quiesce():\n\n  raid5_quiesce(mddev, true);\n  raid5_quiesce(mddev, false);\n\nsince mddev->private is assigned to conf again in raid5_quiesce(), and conf\nis dereferenced in several places, for example:\n\n  conf->quiesce = 0;\n  wake_up(&conf->wait_for_quiescent);\n\nTo fix this issue, the function should unlock mddev and return before\ninvoking raid5_quiesce() when conf is NULL, following the existing pattern\nin raid5_change_consistency_policy().\n\n## Affected\n\n- `Linux >= be19e6e4339d1579d5f2fae8ce4facf9521dbbfc < 20597b7229aea8b5bc45cd92097640257c7fc33b`\n- `Linux >= fa1944bbe6220eb929e2c02e5e8706b908565711 < e5abb6af905de6b2fead8a0b3f32ab0b81468a01`\n- `Linux >= fa1944bbe6220eb929e2c02e5e8706b908565711 < 7ad6ef91d8745d04aff9cce7bdbc6320d8e05fe9`\n- `Linux >= 6.12.4 < 6.12.64`\n- `Linux 6.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}