---
id: CVE-2025-38445
title: 'md/raid1: Fix stack memory use after return in raid1_reshape'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/raid1: Fix stack memory use after return in raid1_reshape

  In the raid1_reshape function, newpool is
  allocated on the stack and assigned to conf->r1bio_pool.
  This re…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 <
    d8a6853d00fbaa810765c8ed2f452a5832273968
  - >-
    Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 <
    12b00ec99624f8da8c325f2dd6e807df26df0025
  - >-
    Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 <
    48da050b4f54ed639b66278d0ae6f4107b2c4e2d
  - >-
    Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 <
    5f35e48b76655e45522df338876dfef88dafcc71
  - >-
    Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 <
    df5894014a92ff0196dbc212a7764e97366fd2b7
  - >-
    Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 <
    776e6186dc9ecbdb8a1b706e989166c8a99bbf64
  - >-
    Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 <
    61fd5e93006cf82ec8ee5c115ab5cf4bbd104bdb
  - >-
    Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 <
    d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98
  - Linux 4.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:56:58.658321Z'
published: '2025-07-25'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:02:38.838Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38445'
references:
  - url: 'https://git.kernel.org/stable/c/d8a6853d00fbaa810765c8ed2f452a5832273968'
  - url: 'https://git.kernel.org/stable/c/12b00ec99624f8da8c325f2dd6e807df26df0025'
  - url: 'https://git.kernel.org/stable/c/48da050b4f54ed639b66278d0ae6f4107b2c4e2d'
  - url: 'https://git.kernel.org/stable/c/5f35e48b76655e45522df338876dfef88dafcc71'
  - url: 'https://git.kernel.org/stable/c/df5894014a92ff0196dbc212a7764e97366fd2b7'
  - url: 'https://git.kernel.org/stable/c/776e6186dc9ecbdb8a1b706e989166c8a99bbf64'
  - url: 'https://git.kernel.org/stable/c/61fd5e93006cf82ec8ee5c115ab5cf4bbd104bdb'
  - url: 'https://git.kernel.org/stable/c/d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98'
tags:
  - cve.org
epss: 0.00199
epssPercentile: 0.0981
ingestedAt: '2026-11-05T22:38:31.972Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: Fix stack memory use after return in raid1_reshape

In the raid1_reshape function, newpool is
allocated on the stack and assigned to conf->r1bio_pool.
This results in conf->r1bio_pool.wait.head pointing
to a stack address.
Accessing this address later can lead to a kernel panic.

Example access path:

raid1_reshape()
{
	// newpool is on the stack
	mempool_t newpool, oldpool;
	// initialize newpool.wait.head to stack address
	mempool_init(&newpool, ...);
	conf->r1bio_pool = newpool;
}

raid1_read_request() or raid1_write_request()
{
	alloc_r1bio()
	{
		mempool_alloc()
		{
			// if pool->alloc fails
			remove_element()
			{
				--pool->curr_nr;
			}
		}
	}
}

mempool_free()
{
	if (pool->curr_nr < pool->min_nr) {
		// pool->wait.head is a stack address
		// wake_up() will try to access this invalid address
		// which leads to a kernel panic
		return;
		wake_up(&pool->wait);
	}
}

Fix:
reinit conf->r1bio_pool.wait after assigning newpool.

## Affected

- `Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < d8a6853d00fbaa810765c8ed2f452a5832273968`
- `Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < 12b00ec99624f8da8c325f2dd6e807df26df0025`
- `Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < 48da050b4f54ed639b66278d0ae6f4107b2c4e2d`
- `Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < 5f35e48b76655e45522df338876dfef88dafcc71`
- `Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < df5894014a92ff0196dbc212a7764e97366fd2b7`
- `Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < 776e6186dc9ecbdb8a1b706e989166c8a99bbf64`
- `Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < 61fd5e93006cf82ec8ee5c115ab5cf4bbd104bdb`
- `Linux >= afeee514ce7f4cab605beedd03be71ebaf0c5fc8 < d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98`
- `Linux 4.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.