Executive brief
The Linux kernel's RAID1 storage driver can crash when a new disk is added to an existing RAID array that has serialization policy enabled. The crash occurs because the driver tries to access uninitialized serialization data structures, causing the system to hang or reboot. This affects systems using software RAID1 with serialization enabled.
Technical details
A null pointer dereference occurs in the md/raid1 driver's wait_for_serialization() function when adding a new rdev (RAID device) to an existing array with MD_SERIALIZE_POLICY enabled. The root cause is that mddev_create_serial_pool() skips initialization of rdev->serial for newly added devices due to a logic error in the condition check. When wait_for_serialization() is later called during I/O handling, it assumes rdev->serial is initialized and attempts to access it, causing a kernel oops. The fix modifies the condition in mddev_create_serial_pool() to check MD_SERIALIZE_POLICY flag first, ensuring serial pools are created for newly added devices. The vulnerability requires a RAID array configured with serialize_policy=1, making it a local issue affecting system availability.
Affected products
- Linux Linux kernel 7.1.3 and likely earlier versions with serialize_policy support
Timeline
- 2026-09-17: disclosed
- 2026-07-23: patched: Fix committed upstream
- 2026-09-14: patched: Fix merged into stable kernel trees