CVE-2026-90389 md: scope memalloc_noio to allocation critical sections

In the Linux kernel, the following vulnerability has been resolved: md: scope memallocnoio to allocation critical sections Storing a memallocnoiosave token in mddev-noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter...

EUVD-2026-82050

In the Linux kernel, the following vulnerability has been resolved: md: scope memallocnoio to allocation critical sections Storing a memallocnoiosave token in mddev-noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter...

CVE-2026-90389 md: scope memalloc_noio to allocation critical sections

In the Linux kernel, the following vulnerability has been resolved: md: scope memallocnoio to allocation critical sections Storing a memallocnoiosave token in mddev-noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter...

CVE-2026-90389

CVE-2026-90389 is a bug in the Linux kernel md (multiple device) subsystem . The root cause is that a memalloc_noio_save() token is stored in mddev->noio_flags, allowing one task to save the token and another task to restore it . With concurrent sysfs writes to suspend_lo and suspend_hi, task ...

CVE-2026-90385 md/raid1: create serial pool adding rdev to array with serialize_policy=1

In the Linux kernel, the following vulnerability has been resolved: md/raid1: create serial pool adding rdev to array with serializepolicy=1 The following bug has been observed with kernel 7.1.3 after adding a new rdev to an existing RAID1 array with serializepolicy enabled: Oops: 0002 1 CPU: 0...

CVE-2026-90279 md/raid5: round bitmap stripes with sector division

In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5bitmapsectormap aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunksectors multiplied by the number of data...

CVE-2026-90279 md/raid5: round bitmap stripes with sector division

In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5bitmapsectormap aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunksectors multiplied by the number of data...

CVE-2026-90279

CVE-2026-90279 affects the Linux kernel md/raid5 subsystem, specifically the raid5_bitmap_sector_map() function. The root cause is that this function aligns array ranges to full RAID5 stripe widths using round_down()/round_up() mask-based arithmetic, which fails when the stripe width (chunk secto...

EUVD-2026-81871

In the Linux kernel, the following vulnerability has been resolved: md: wait for behind writes before destroying bitmap mdstop destroyed the bitmap before calling mddevdetach. That made mddevdetach skip bitmapops-waitbehindwrites, because the bitmap was already disconnected from mddev. This was...

CVE-2026-90278 md: wait for behind writes before destroying bitmap

In the Linux kernel, the following vulnerability has been resolved: md: wait for behind writes before destroying bitmap mdstop destroyed the bitmap before calling mddevdetach. That made mddevdetach skip bitmapops-waitbehindwrites, because the bitmap was already disconnected from mddev. This was...

CVE-2026-90278

CVE-2026-90278 is a use-after-free vulnerability in the Linux kernel's md (multiple device) subsystem , specifically in the bitmap teardown path of __md_stop(). The bug occurred because the bitmap was destroyed before mddev_detach() was called, causing the detach path to skip bitmap_ops->wait_...

EUVD-2026-81870

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmapcreate publishes mddev-bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb can initialize a new bitmap and flush it through helpers that use...

CVE-2026-90277 md/md-llbitmap: prevent create failure bitmap UAF

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmapcreate publishes mddev-bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb can initialize a new bitmap and flush it through helpers that use...

CVE-2026-90277 md/md-llbitmap: prevent create failure bitmap UAF

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmapcreate publishes mddev-bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb can initialize a new bitmap and flush it through helpers that use...

CVE-2026-90275

CVE-2026-90275 is a Linux kernel bug in the md/raid1 (Software RAID mirror) driver. In raid1_takeover(), the code sets conf->array_frozen = 1 on the newly-allocated r1conf structure, but nothing subsequently clears it. This became impactful after commit b39f35ebe86d ("md: don't quiesce in mdde...

CVE-2026-90275 md/raid1: don't set array_frozen in raid1_takeover()

In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set arrayfrozen in raid1takeover raid1takeover sets conf-arrayfrozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once waitbarrier sees it stuck at 1...

CVE-2026-90275 md/raid1: don't set array_frozen in raid1_takeover()

In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set arrayfrozen in raid1takeover raid1takeover sets conf-arrayfrozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once waitbarrier sees it stuck at 1...

EUVD-2026-81869

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: stop daemon timer rearm on destroy llbitmapdestroy deletes pendingtimer before flushing mdllbitmapiowq. However, daemonwork can still be queued or running after the timer has been deleted, and the daemon path can...

CVE-2026-90276

CVE-2026-90276 is a use-after-free in the Linux kernel's md/md-llbitmap (software RAID) subsystem. During llbitmap_destroy(), the pending_timer is deleted before flushing the shared I/O workqueue. However, daemon_work may still be queued or running, and the daemon path can rearm pending_timer whe...

CVE-2026-90276 md/md-llbitmap: stop daemon timer rearm on destroy

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: stop daemon timer rearm on destroy llbitmapdestroy deletes pendingtimer before flushing mdllbitmapiowq. However, daemonwork can still be queued or running after the timer has been deleted, and the daemon path can...