Executive brief
The Linux kernel's RAID 1 storage module has a bug where converting between storage configurations causes all input/output operations to permanently freeze. When a RAID array configuration is changed, a flag meant to be temporary is never cleared, blocking all disk access indefinitely until the system is restarted or the array is reset.
Technical details
The vulnerability is a resource state management bug in the raid1_takeover() function within the md (multiple device) RAID 1 driver. The function sets conf->array_frozen = 1 when configuring a new RAID 1 instance during level conversion, but this flag is never cleared because a prior cleanup path (mddev_resume() → raid1_quiesce(mddev, 0)) was removed by an earlier kernel commit. The array_frozen flag, when set to 1, causes the _wait_barrier() function to block all I/O indefinitely. The fix removes the unnecessary pre-setting of array_frozen, relying instead on kzalloc's zero-initialization of the r1conf structure. The bug affects the raid1_takeover() code path, triggered when users attempt to change RAID levels. No network or privilege escalation is involved; the impact is local denial of service on systems using RAID 1.
Affected products
- Linux Linux kernel multiple kernel versions affected by commit b39f35ebe86d and onwards
Timeline
- 2026-09-17: disclosed: CVE-2026-90275 published on NVD
- 2026-08-03: patched: Fix committed by Bruce Johnston; backported to stable trees