Executive brief
The Linux kernel's RAID5 disk management component contains a double-free vulnerability in the error-handling path for reading data with bad blocks. An attacker with local access to a system running RAID5 can trigger a kernel panic or potentially execute code by triggering chunk-sized reads on disks with badblocks, causing the system to become unavailable.
Technical details
The vulnerability is a double-free condition in the raid5_read_one_chunk() function in the md/raid5 subsystem. The root cause is an unnecessary bio_put() call in the badblock error path that was not removed when the error checking was moved ahead of bio_alloc_clone() in commit c82aa1b76787c. After the code reorganization, the raid_bio is owned and freed by the common I/O path, but the error path still calls bio_put(), resulting in a double-free. The attack vector is local; an attacker can trigger this by issuing chunk-sized reads on RAID5 volumes with badblocks. No authentication is required. Exploitation results in kernel panic (denial of service) or potential code execution via heap corruption.
Affected products
- Linux Linux kernel affected versions from commit c82aa1b76787c onwards (approximately Linux 5.16+)
Timeline
- 2025-12-24: disclosed
- 2022: advisory: CVE-2022-50752 assigned