Junglewise Threat Intelligence

CVE-2026-90390: Linux kernel md/bitmap resource leak in backlog_store() error path

CVE-2026-90390 · Severity: info · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's RAID bitmap management code has a defect where an error condition fails to properly resume a suspended storage array, leaving it in a blocked state. This prevents subsequent I/O operations from proceeding on the affected RAID array, causing a denial of service until the system is restarted or the issue is manually cleared.

Technical details

The vulnerability exists in the backlog_store() function in drivers/md/md-bitmap.c. When setting backlog for a RAID array, the function suspends the array before validating that a write-mostly device exists. If validation fails (no write-mostly device is available), the error path calls mddev_unlock() to release the configuration lock but fails to call mddev_resume() to restore the array to operational state. This leaves the array suspended indefinitely, blocking all subsequent I/O. The fix changes the error path to use mddev_unlock_and_resume() instead of mddev_unlock() alone. The vulnerability affects multiple kernel versions and requires local access to trigger (via the backlog sysfs attribute). A patch is available in stable kernel trees.

Affected products

  • Linux Linux Kernel Multiple versions (fix applied across stable branches linux-2.6.11.y through linux-7.2.y and rolling branches)

Timeline

  • 2026-09-17: disclosed: CVE-2026-90390 published
  • 2026-07-31: patched: Upstream commit 2911cd0a0f4366a7e06832bc5f0a7fdcc138e4dc applied
  • 2026-09-14: other: Backported to stable kernel trees (commit 03aad318f0a1f039dddf98739e705fdca3bf0d86)

References

Related threats