Executive brief
A race condition in the Linux kernel's RAID management subsystem can cause the system to crash when spare disk configuration changes occur during normal I/O operations. When a RAID array detects spare changes while data is being written, it may attempt to dereference a NULL pointer, resulting in a kernel panic that disrupts storage availability.
Technical details
The vulnerability is a NULL pointer dereference caused by a race condition in md_start_sync() and remove_spares(). The vulnerable component fails to properly synchronize spare device configuration changes with concurrent I/O operations. An attacker with the ability to trigger spare configuration changes (e.g., marking devices faulty via /sys/block/mdX interfaces) can race with normal I/O to cause rdev_dec_pending() to be called with a NULL pointer, which dereferences in the nr_pending decrement logic. The race requires precise timing between raid10d kernel threads and user-initiated I/O, making it a local vulnerability reachable by unprivileged users on affected systems. The fix involves suspending the array and rechecking spare changes after acquiring the reconfig mutex to eliminate the window between the initial check and the mutex acquisition.
Affected products
- Linux Linux kernel affected versions prior to fix (exact version range not specified in advisory)
Timeline
- 2026-09-17: disclosed