Executive brief
A vulnerability in the Linux kernel's RAID10 storage driver can cause a system deadlock, leading to a complete loss of availability for storage services. This occurs when a disk array consistency check is performed simultaneously with specific types of high-performance data requests. An exploit or accidental trigger would result in a system hang, requiring a reboot and potentially disrupting business operations and data access.
Technical details
A deadlock exists in the Linux kernel md/raid10 driver due to an improper accounting of pending I/O requests. When an array check is initiated, it raises a synchronization barrier. Standard I/O requests increment a 'nr_pending' counter and block, but NOWAIT requests return an error without incrementing this counter. However, a previous fix for a memory leak introduced a call to raid_end_bio_io() for NOWAIT requests, which unconditionally decrements 'nr_pending'. This leads to a counter underflow, causing the kernel's resync thread to wait indefinitely for the counter to reach zero. The vulnerability can be triggered locally by starting an array check while NOWAIT I/O is active. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel RAID10 driver
Timeline
- 2026-03-02: other: Patch authored by Josh Hunt
- 2026-05-07: patched: Patch committed to stable tree
- 2026-05-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1cdff2937c618f81058422bbdc4974a3e7ec9379
- https://git.kernel.org/stable/c/42fe37c90184cd1568838b84b488934c3671c963
- https://git.kernel.org/stable/c/7d96f3120a7fb7210d21b520c5b6f495da6ba436
- https://git.kernel.org/stable/c/965d6162dd88cc7cc193cf7f5bfc132d8bbf0523
- https://git.kernel.org/stable/c/cac2106bb9a2180b288079b49ed626414fb5bc45