Executive brief
The Linux kernel's RAID bitmap management code has a defect where an error condition fails to properly resume a suspended storage array, leaving it in a blocked state. This prevents subsequent I/O operations from proceeding on the affected RAID array, causing a denial of service until the system is restarted or the issue is manually cleared.
Technical details
The vulnerability exists in the backlog_store() function in drivers/md/md-bitmap.c. When setting backlog for a RAID array, the function suspends the array before validating that a write-mostly device exists. If validation fails (no write-mostly device is available), the error path calls mddev_unlock() to release the configuration lock but fails to call mddev_resume() to restore the array to operational state. This leaves the array suspended indefinitely, blocking all subsequent I/O. The fix changes the error path to use mddev_unlock_and_resume() instead of mddev_unlock() alone. The vulnerability affects multiple kernel versions and requires local access to trigger (via the backlog sysfs attribute). A patch is available in stable kernel trees.
Affected products
- Linux Linux Kernel Multiple versions (fix applied across stable branches linux-2.6.11.y through linux-7.2.y and rolling branches)
Timeline
- 2026-09-17: disclosed: CVE-2026-90390 published
- 2026-07-31: patched: Upstream commit 2911cd0a0f4366a7e06832bc5f0a7fdcc138e4dc applied
- 2026-09-14: other: Backported to stable kernel trees (commit 03aad318f0a1f039dddf98739e705fdca3bf0d86)