Executive brief
The Linux kernel RAID10 storage driver incorrectly handles recovery of degraded disk arrays, causing silent data corruption. When one disk is missing and another disk is being recovered, the kernel fails to preserve necessary recovery metadata, allowing the recovering disk to be marked as healthy while containing stale data. This can lead to undetected file corruption in systems relying on RAID10 arrays for data protection.
Technical details
A logic inversion bug in raid10_sync_request() incorrectly sets still_degraded to false when a mirror disk is missing, when it should be true. This causes md_bitmap_start_sync() to be called with degraded==false, clearing bitmap bits that track which regions need recovery on the re-added disk. When the missing disk is re-added, bitmap-based recovery skips all regions that were written during the degraded window, leaving stale data while marking the disk as in-sync. The vulnerability affects RAID10 arrays using internal bitmaps and requires a specific sequence: array degradation, writes, and disk re-addition. The fix is a single-line change restoring the correct boolean value, and patches are available in Linux kernel stable trees.
Affected products
- Linux Linux Kernel Multiple versions (kernel/git stable repository shows patches across 2.6.11 through 7.2)
Timeline
- 2026-09-11: disclosed: CVE-2026-89558 published
- 2026-09-07: patched: Fix committed to stable kernel trees by Greg Kroah-Hartman
- 2026-07-23: other: Original patch authored by Yunye Zhao