CVE-2026-46051

A flaw was found in the Linux kernel's md/raid5 component. When the retryalignedread function encounters an overlapped stripe, an issue in how stripes are released and processed can lead to an infinite loop. This prevents the system from resolving the overlap, resulting in a soft lockup and a...

CVE-2026-46070

A flaw was found in the Linux kernel's md/raid5 component. This vulnerability arises from insufficient validation of payload sizes within journal metadata blocks. A local attacker can exploit this by providing a corrupted journal, leading to out-of-bounds reads when the system processes payload...

AZL-88449 CVE-2026-46070 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: md/raid5: validate payload size before accessing journal metadata r5crecoveryanalyzemetablock and r5lrecoveryverifydatachecksumformb iterate over payloads in a journal metadata block using on-disk payload size fields without...

CVE-2026-46070

In the Linux kernel, the following vulnerability has been resolved: md/raid5: validate payload size before accessing journal metadata r5crecoveryanalyzemetablock and r5lrecoveryverifydatachecksumformb iterate over payloads in a journal metadata block using on-disk payload size fields without...

AZL-88734 CVE-2026-46051 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix soft lockup in retryalignedread When retryalignedread encounters an overlapped stripe, it releases the stripe via raid5releasestripe which puts it on the lockless releasedstripes llist. In the next raid5d loop...

UBUNTU-CVE-2026-45953

In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix IO hang with degraded array with llbitmap When llbitmap bit state is still unwritten, any new write should force rcw, as bitmapops-blockssynced is checked in handlestripedirtying. However, later the same check is...

CVE-2026-46070

CVE-2026-46070 pertains to the Linux kernel md/raid5 path where journal metadata blocks could be overrun due to missing validation of on-disk payload sizes. r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() may read or offset beyond a page boundary when payload size...

CVE-2026-46070

In the Linux kernel, the following vulnerability has been resolved: md/raid5: validate payload size before accessing journal metadata r5crecoveryanalyzemetablock and r5lrecoveryverifydatachecksumformb iterate over payloads in a journal metadata block using on-disk payload size fields without...

CVE-2026-46070 md/raid5: validate payload size before accessing journal metadata

In the Linux kernel, the following vulnerability has been resolved: md/raid5: validate payload size before accessing journal metadata r5crecoveryanalyzemetablock and r5lrecoveryverifydatachecksumformb iterate over payloads in a journal metadata block using on-disk payload size fields without...

CVE-2026-46051

CVE-2026-46051 affects the Linux kernel's MD RAID5 path. The vulnerability arises when retry_aligned_read() encounters an overlapped stripe and releases it via raid5_release_stripe(), placing it on the released_stripes list. In a subsequent raid5d loop, release_stripe_list() drains the stripe ont...

CVE-2026-45953

CVE-2026-45953 affects the Linux kernel’s MD RAID5 subsystem. The root cause is a missing check in need_this_block() when an llbitmap bit is unwritten in a degraded array, which can cause stripe handling to deadlock and trigger an I/O hang (DoS-like impact). Public sources describe the issue and ...

CVE-2026-46051: Improper Locking

In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix soft lockup in retryalignedread When retryalignedread encounters an overlapped stripe, it releases the stripe via raid5releasestripe which puts it on the lockless releasedstripes llist. In the next raid5d loop...

CVE-2026-46070: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: md/raid5: validate payload size before accessing journal metadata r5crecoveryanalyzemetablock and r5lrecoveryverifydatachecksumformb iterate over payloads in a journal metadata block using on-disk payload size fields without...

CVE-2026-45953: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix IO hang with degraded array with llbitmap When llbitmap bit state is still unwritten, any new write should force rcw, as bitmapops-blockssynced is checked in handlestripedirtying. However, later the same check is...

Linux Distros Unpatched Vulnerability : CVE-2026-46051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - md/raid5: fix soft lockup in retryalignedread When retryalignedread encounters an overlapped stripe, it releases the stripe via raid5releasestripe which puts it...

The vulnerability of the r5l_logFlushEndio() function in the drivers/md/raid5-cache.c module of the Linux driver for multiple device types (RAID and LVM) allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the r5llogFlushEndio function in the drivers/md/raid5-cache.c module of the Linux device driver for multiple devices RAID and LVM is related to the race condition that occurs when a shared resource is used. Exploiting this vulnerability could allow an attacker to compromise t...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-004840)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004840 advisory. In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug In line 2884, raid5releasestripesh %NASLMINLEVEL...

SUSE CVE-2025-71135

In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix possible null-pointer dereferences in raid5storegroupthreadcnt The variable mddev-private is first assigned to conf and then checked: conf = mddev-private; if !conf ... If conf is NULL, then mddev-private is also...

CVE-2025-71135

In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix possible null-pointer dereferences in raid5storegroupthreadcnt The variable mddev-private is first assigned to conf and then checked: conf = mddev-private; if !conf ... If conf is NULL, then mddev-private is also...

UBUNTU-CVE-2025-71135

In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix possible null-pointer dereferences in raid5storegroupthreadcnt The variable mddev-private is first assigned to conf and then checked: conf = mddev-private; if !conf ... If conf is NULL, then mddev-private is also...