Executive brief
A vulnerability in the Linux kernel's Multiple Device (MD) driver can cause a system deadlock when managing storage arrays. By sending a specific command to clear an array's state, the system may experience a recursive locking failure that halts operations. This primarily impacts system availability and requires administrative privileges to trigger.
Technical details
A deadlock exists in the Linux kernel MD (Multiple Device) driver due to improper reference counting and lock handling in md_attr_store(). When 'clear' is written to array_state, the function breaks sysfs active protection to allow the array to delete itself. However, it drops the mddev reference before calling sysfs_unbreak_active_protection(). This can result in the last kobject reference being dropped within the sysfs writer context, causing recursive locking on kn->active during kernfs removal. The fix involves restoring active protection before calling mddev_put() to ensure deletion is deferred until the sysfs write path has unwound.
Affected products
- Linux Linux Kernel 9e59d609763f to 62c44566da7493ee48ef17e8507bb798338a07cb
Timeline
- 2026-03-30: disclosed: Initial patch submission by Yu Kuai
- 2026-06-24: advisory: CVE-2026-53125 published