Executive brief
A vulnerability in the Linux kernel's RAID10 storage driver could allow a local user to crash the system. The issue occurs when configuring specific disk layouts, leading to a mathematical error that halts the operating system. This could result in a service outage and potential data unavailability until the system is rebooted.
Technical details
A divide-by-zero vulnerability exists in the 'setup_geo()' function within 'drivers/md/raid10.c' of the Linux kernel. The function extracts 'near_copies' (nc) and 'far_copies' (fc) from user-provided layout parameters without verifying if these values are non-zero. When 'far_copies' is set to zero while using the 'improved' far set layout, the kernel attempts to calculate 'geo->far_set_size = disks / fc', resulting in a kernel panic. This issue is reachable via local administrative actions or tools that interface with the MD (Multiple Device) driver. Patches have been released to validate these parameters and return an error if either value is zero.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-16: other: Patch authored
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/4af2e558e6fdfb972c61350653fd55d1f62b60a5
- https://git.kernel.org/stable/c/913d556e4bd1b56ed822815655b82c7bb54edc51
- https://git.kernel.org/stable/c/9aa6d860b0930e2f72795665c42c44252a558a0c
- https://git.kernel.org/stable/c/9d8e03b9a2b1e8ce5c198bf3a409a629f4d02cda
- https://git.kernel.org/stable/c/f9ddb621b2325eb69c95692958daf2bab4dea2c4