CVE-2025-38621

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.16.0+ #94

Description: A flaw exists in the Linux kernel related to the md (Multiple Devices) subsystem. A test case triggers a kernel panic due to a NULL pointer dereference within the rdev addable function. The issue arises because md spares need change in md start sync calls rdev addable, which is protected by RCU read locks. This can lead to the rdev->mddev pointer being set to NULL before synchronization occurs in md kick rdev from array.

Recommendations: Update to Linux kernel version 6.16.0+ #94 or later to resolve this issue.