Executive brief
A vulnerability in the Linux kernel's RAID5 implementation can cause a system hang or 'deadlock' when using a degraded storage array with a specific bitmap configuration. This issue occurs during write operations, potentially leading to a complete loss of availability for the affected storage volume. While it does not directly expose data, the resulting system instability can disrupt business operations and require a manual reboot to recover.
Technical details
A logic error in the Linux kernel's md/raid5 driver leads to an I/O hang when using a degraded array with the lockless bitmap (llbitmap). The vulnerability exists because the 'need_this_block()' function lacks a check for 'bitmap_ops->blocks_synced()', which is present in 'handle_stripe_dirtying()'. When a write occurs and the bitmap state is unwritten, 'handle_stripe()' attempts to perform a fill operation ('handle_stripe_fill'), but 'need_this_block()' incorrectly returns 0. This results in a deadloop where the stripe is repeatedly processed but never handled. The issue was introduced by the lockless bitmap implementation and has been resolved by ensuring 'force_rcw' is correctly set in 'need_this_block()' when blocks are not synced.
Affected products
- Linux Linux kernel Fixed in 28ef299e7a5b, 870b9f15867b, cd1635d844d2
Timeline
- 2026-01-24: other: Patch authored
- 2026-05-27: advisory: NVD published CVE-2026-45953