Two-Primaries DRBD Vulnerability in Linux Kernel Affecting Data Integrity

CVE-2025-38708

What is CVE-2025-38708?

A vulnerability exists in the Linux kernel's DRBD where the lack of a required reference count increase ('kref_get') leads to potential use after free errors when handling concurrent writes. This issue is pertinent mainly when the 'two-primaries' feature is enabled. Although designed to manage concurrent writes effectively, the oversight can result in device destruction and subsequent kernel crashes, particularly affecting systems not correctly managing concurrent writes through upper layers. Modern implementations of DRBD in subsequent versions have adjusted their handling of conflicts, simplifying the logic to disconnect on detecting potential issues.

References