What is the severity of CVE-2025-68373?

CVE-2025-68373 has a CVSS v3 score of 0, which is classified as Low severity.

Is there an exploit available for CVE-2025-68373?

No known public exploits are currently available for CVE-2025-68373.

Is there a patch available for CVE-2025-68373?

Yes, patches are available for CVE-2025-68373. Check the vendor advisories for update instructions.

CVE-2025-68373 - CVE Details, Severity, and Analysis

Severity Scores

CVSS v30.0

CVSS v20.0

Priority Score0.0

EPSS Score0.0

None

Exploitation LikelihoodMinimal

0.00%EPSS

Very low probability of exploitation

Monitor and patch as resources allow

0.00%

EPSS

0.0

CVSS

No

Exploit

Yes

Patch

Low Priority

no major risk factors

EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.

Description

In the Linux kernel, the following vulnerability has been resolved:

md: avoid repeated calls to del_gendisk

There is a uaf problem which is found by case 23rdev-lifetime:

Oops: general protection fault, probably for non-canonical address 0xdead000000000122 RIP: 0010:bdi_unregister+0x4b/0x170 Call Trace: <TASK> __del_gendisk+0x356/0x3e0 mddev_unlock+0x351/0x360 rdev_attr_store+0x217/0x280 kernfs_fop_write_iter+0x14a/0x210 vfs_write+0x29e/0x550 ksys_write+0x74/0xf0 do_syscall_64+0xbb/0x380 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff5250a177e

The sequence is:

rdev remove path gets reconfig_mutex
rdev remove path release reconfig_mutex in mddev_unlock
md stop calls do_md_stop and sets MD_DELETED
rdev remove path calls del_gendisk because MD_DELETED is set
md stop path release reconfig_mutex and calls del_gendisk again

So there is a race condition we should resolve. This patch adds a flag MD_DO_DELETE to avoid the race condition.

CVSS v3 Breakdown

Attack Vector:-

Attack Complexity:-

Privileges Required:-

User Interaction:-

Scope:-

Confidentiality:-

Integrity:-

Availability:-