Executive brief
The Linux kernel's RAID5 disk management subsystem contains a race condition that can occur when multiple threads simultaneously manage stripe batches. An attacker or system condition causing concurrent access to the same disk stripe could cause the system to hang indefinitely, resulting in service unavailability and potential data loss on systems relying on RAID5 arrays.
Technical details
A data race exists in the md/raid5 subsystem between break_stripe_batch_list() and raid5_make_request() on the R5_Overlap flag within stripe device structures. The vulnerability occurs when one CPU clears the R5_Overlap bit while another CPU simultaneously sets it, without proper synchronization. This results in a waiting thread never being awakened (missing wake_up_bit() call), causing a task to hang indefinitely in wait_on_bit(). The race requires concurrent access to overlapping stripes and no user authentication. The fix expands the protected critical section and moves batch_head nullification to the end of the protected zone, ensuring proper serialization of flag updates and wake events.
Affected products
- Linux Linux Kernel prior to fix (exact versions not specified in advisory)
Timeline
- 2026-08-15: disclosed: CVE-2026-72420 published
- other: KCSAN detected data race; fix involves expanding protected critical section and reordering batch_head nullification