Executive brief
A vulnerability in the Linux kernel's RAID management system can cause a complete system hang when stopping or removing certain storage configurations. This occurs specifically when using the device-mapper (dm-raid) target with metadata. If an administrator attempts to dismantle a RAID array while its underlying components are suspended, the system may enter an indefinite block, leading to a denial of service and requiring a hard reboot.
Technical details
A race condition or logic error exists in the Linux kernel's md/raid driver when interacting with the dm-raid target. When a dm-raid managed device tree is suspended from top to bottom and the top-level RAID device is subsequently removed, the dm-raid destructor calls md_stop(). This function attempts to flush the write-intent bitmap by writing to metadata sub-devices that are already in a suspended state. Because the suspended devices cannot complete the I/O operation, the process blocks indefinitely, resulting in a system hang. The fix involves modifying __md_stop_writes in drivers/md/md.c to prevent bitmap flushing and quiescing cycles when called from the dm-raid destructor context, while still allowing them during standard suspend paths.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026-03-04
Timeline
- 2026-01-14: other: Patch authored
- 2026-03-04: patched: Patch committed to stable tree
- 2026-05-08: disclosed: CVE published