CVE-2025-68374

CVE-2025-68374 : In the Linux kernel, the md subsystem had an RCU protection issue around md_wakeup_thread. The pointer to the md thread was passed directly to md_wakeup_thread() before rcu_read_lock() was taken, meaning the RCU read-side protection could be bypassed and potentially lead to a use...

CVE-2025-68374 md: fix rcu protection in md_wakeup_thread

In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in mdwakeupthread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling mdwakeupthread. This means that the RCU pointer has been acquired before rcureadlock,...

CVE-2025-68374 md: fix rcu protection in md_wakeup_thread

In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in mdwakeupthread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling mdwakeupthread. This means that the RCU pointer has been acquired before rcureadlock,...

CVE-2025-68373 md: avoid repeated calls to del_gendisk

In the Linux kernel, the following vulnerability has been resolved: md: avoid repeated calls to delgendisk There is a uaf problem which is found by case 23rdev-lifetime: Oops: general protection fault, probably for non-canonical address 0xdead000000000122 RIP: 0010:bdiunregister+0x4b/0x170 Call...

CVE-2025-68373

Summary: CVE-2025-68373 relates to the Linux kernel md subsystem where a race can trigger use-after-free in del_gendisk during reconfig, leading to a fault (non-canonical address 0xdead000000000122) as shown in the stack trace. The provided patches introduce a new flag, MD_DO_DELETE, to prevent t...

CVE-2025-68368

In CVE-2025-68368, the Linux kernel vulnerability arises in md: init bioset in mddev_init, where IO operations before md_run() (e.g., metadata updates after sysfs writes) can trigger a NULL pointer dereference if bioset is not initialized. Repro: mdadm -CR /dev/md0 -l1 -n2 /dev/sd[cd]; echo inact...

Linux Distros Unpatched Vulnerability : CVE-2025-68373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - md: avoid repeated calls to delgendisk There is a uaf problem which is found by case 23rdev-lifetime: Oops: general protection fault, probably for non-canonical...

PT-2025-52910

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to RCU protection within the md wakeup thread function. An attempt was made to use Read-Copy-Update RCU to protect a pointer, thread, but the...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from improper RCU protection in mdwakeupthread, which could lead to reuse after release...

Linux Distros Unpatched Vulnerability : CVE-2025-68374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - md: fix rcu protection in mdwakeupthread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling mdwakeupthread. Thi...

Security update for apache2

This update for apache2 fixes the following issues: CVE-2025-55753: Fixed modmd ACME unintended retry intervals bsc1254511 CVE-2025-65082: Fixed CGI environment variable override bsc1254514 CVE-2025-58098: Fixed Server Side Includes adding query string to exec cmd=... bsc1254512 CVE-2025-66200:...

AlmaLinux 10 : mod_md (ALSA-2025:23738)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:23738 advisory. modmd: Apache HTTP Server: modmd ACME, unintended retry intervals CVE-2025-55753 Tenable has extracted the preceding description block directly from the AlmaLinu...

Important: Red Hat Security Advisory: mod_md security update

An update for modmd is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

RockyLinux 8 : httpd:2.4 (RLSA-2025:23732)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:23732 advisory. httpd: Apache HTTP Server: CGI environment variable override CVE-2025-65082 modmd: Apache HTTP Server: modmd ACME, unintended retry intervals...

mod_md security update

1:2.4.26-1.1 - Resolves: RHEL-134496 - httpd: Apache HTTP Server: modmd ACME, unintended retry intervals CVE-2025-55753...

EulerOS Virtualization 2.13.1 : krb5 (EulerOS-SA-2025-2547)

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesse...

[SECURITY] Fedora 43 Update: mod_md-2.6.7-1.fc43

This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal...

Oracle Linux 7 : kernel (ELSA-2025-21063)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-21063 advisory. - HID: core: fix shift-out-of-bounds in hidreportrawevent CVE-2022-48978 Orabug: 38644370 - crypto: seqiv - Handle EBUSY correctly CVE-2023-53373...

Apache HTTP Server: mod_md (ACME), unintended retry intervals

...

EUVD-2025-202614

Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt the TLS traffic, inspect its contents, and modify the requests in transit. This may result in a total compromise of the user's account if t...