Executive brief
A vulnerability was identified in the Linux kernel's RAID5 implementation where it failed to properly validate data sizes when recovering from a system crash or power failure. If a storage device's journal becomes corrupted, it could cause the system to read memory outside of intended boundaries. This could lead to system instability or crashes during the RAID recovery process, potentially impacting data availability.
Technical details
An out-of-bounds read vulnerability exists in the md/raid5 cache recovery logic within the Linux kernel. Specifically, the functions r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() iterate over journal metadata payloads using on-disk size fields without verifying if those sizes exceed the allocated metadata block (PAGE_SIZE). A maliciously crafted or corrupted journal with oversized payload fields can trigger out-of-bounds reads during offset computation or field access. The fix introduces bounds validation for R5LOG_PAYLOAD_DATA, R5LOG_PAYLOAD_PARITY, and R5LOG_PAYLOAD_FLUSH types to ensure they fit within the meta_size boundary.
Affected products
- Linux Linux Kernel Fixed in versions 33698bd, 406aa86, 73ce72e, b0cc3ae, c3a1cf7
Timeline
- 2026-04-04: other: Patch authored by Junrui Luo
- 2026-05-27: disclosed: CVE published by kernel.org and NVD
References
- https://git.kernel.org/stable/c/33698bd1b2db9764a29df7751533d33967ff5c98
- https://git.kernel.org/stable/c/406aa86394ead347c47428fb51b6359bdaa2257d
- https://git.kernel.org/stable/c/73ce72edd113374801045924d4417199963f73a3
- https://git.kernel.org/stable/c/b0cc3ae97e893bf54bbce447f4e9fd2e0b88bff9
- https://git.kernel.org/stable/c/c3a1cf78bd1bbb51b2cc5189b4743056553c1e0e