Executive brief
The Linux RAID management (MD) driver had a flaw where concurrent suspend operations could allow one process to leave memory allocation restrictions active after returning to user space, with another process later removing those restrictions. This is a kernel-level resource scope management issue that could lead to unexpected memory allocation behavior or system instability in RAID array suspend operations.
Technical details
The vulnerability is a scope mismanagement bug in the Linux kernel's RAID (MD) subsystem. The memalloc_noio_save() token was being stored in mddev->noio_flags, allowing one task to save the token and another task to restore it during concurrent suspend sysfs writes. An attacker or malicious process could trigger concurrent writes to suspend_lo and suspend_hi sysfs attributes, causing task A to enter PF_MEMALLOC_NOIO scope, return to userspace while still in that scope, and later have task B restore A's token, breaking scope isolation. The fix scopes the memalloc_noio token to critical memory allocation sections rather than tying it to mddev suspend/resume lifecycle. The patch was merged upstream and backported to stable kernels.
Affected products
- Linux Linux kernel multiple kernel versions prior to fix
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Patch merged to stable tree
- 2026-07-18: other: Original upstream fix commit