---
id: CVE-2025-22124
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb

  In clustermd, separate write-intent-bitmaps are used for each cluster
  node:

  0                    4k  …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb

  In clustermd, separate write-intent-bitmaps are used for each cluster
  node:

  0                    4k  …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.6.44, < 6.7'
  - 'linux_kernel >= 6.10.3, < 6.12.46'
  - 'linux_kernel >= 6.13, < 6.14.2'
patched:
  - linux_kernel 6.14.2
published: '2025-04-16'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:15.483'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-22124'
references:
  - url: 'https://git.kernel.org/stable/c/5eaf57fdfa37c869e61e9908e03edd707f9145b8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/60196f92bbc7901eb5cfa5d456651b87ea50a4a3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6130825f34d41718c98a9b1504a79a23e379701e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bc3a9788961631359527763d7e1fcf26554c7cb1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00198
epssPercentile: 0.09547
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:44:34.243767Z'
ingestedAt: '2026-09-14T15:23:07.459Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb

In clustermd, separate write-intent-bitmaps are used for each cluster
node:

0                    4k                     8k                    12k
-------------------------------------------------------------------
| idle                | md super            | bm super [0] + bits |
| bm bits[0, contd]   | bm super[1] + bits  | bm bits[1, contd]   |
| bm super[2] + bits  | bm bits [2, contd]  | bm super[3] + bits  |
| bm bits [3, contd]  |                     |                     |

So in node 1, pg_index in __write_sb_page() could equal to
bitmap->storage.file_pages. Then bitmap_limit will be calculated to
0. md_super_write() will be called with 0 size.
That means the first 4k sb area of node 1 will never be updated
through filemap_write_page().
This bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize.

Here use (pg_index % bitmap->storage.file_pages) to make calculation
of bitmap_limit correct.

## Affected

- `linux_kernel >= 6.6.44, < 6.7`
- `linux_kernel >= 6.10.3, < 6.12.46`
- `linux_kernel >= 6.13, < 6.14.2`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.14.2`