{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90401", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.811Z", "datePublished": "2026-09-17T16:09:31.556Z", "dateUpdated": "2026-10-19T09:03:05.286Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:03:05.286Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: remove REQ_NOWAIT support from raid1/10/456\n\nREQ_NOWAIT support in md personalities that can block internally is\nfundamentally incomplete. While reads can avoid some blocking paths,\nwrite requests can still encounter cases where one mirror succeeds while\nanother returns -EAGAIN. At that point md cannot distinguish queue\npressure from a real device failure, so it can neither record a bad\nblock nor safely retry the write without REQ_NOWAIT, leaving mirrors\nwith divergent data.\n\nRather than continue advertising REQ_NOWAIT support for personalities\nthat cannot implement it correctly, remove it from raid1, raid10 and\nraid456. Keep REQ_NOWAIT for linear and raid0, which only remap bios to\ntheir underlying devices; stacked limits will still clear the feature if\nany component device lacks REQ_NOWAIT support."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The REQ_NOWAIT bit that drives the bug is set in blkdev_direct_IO() from IOCB_NOWAIT (pwritev2 RWF_NOWAIT or io_uring io_write() with O_DIRECT) on the md gendisk, then md_submit_bio()->raid1_write_request()/raid10_write_request(). nfsd, ksmbd, nvmet_bdev_execute_rw(), and iSCSI iblock submit ordinary READ/WRITE bios without REQ_NOWAIT, so no protocol message carries the flag.\nAC:L - md_init_stacking_limits() advertised BLK_FEAT_NOWAIT, so member clones kept REQ_NOWAIT and raid1_should_handle_error() ignored their failures. The attacker issues concurrent O_DIRECT nowait writes via io_uring/pwritev2 to fill one member's request queue until it returns BLK_STS_AGAIN while the other mirror completes; no uninfluenced race is required.\nPR:L - blkdev_direct_IO() performs no capable() check. Any process that can open the md node or a stacked dm LV (disk group, container CSI block volume, or a delegated /dev/mdX) can issue RWF_NOWAIT O_DIRECT I/O; init-namespace root is not required.\nUI:N - The attacker opens the md block device themselves and issues pwritev2(RWF_NOWAIT) or io_uring io_write(); no separate victim must mount a filesystem, attach media, or confirm an action.\nS:U - Divergent raid1/raid10 mirrors and skipped WriteErrorSeen/bad-block recording remain inside the host md array. The bug does not escape a VM, bypass an IOMMU, or cross another security authority.\nC:N - raid1_end_write_request() ignore_error only skips WriteErrorSeen and R1BIO_WriteError; it does not read other tenants' data or kernel memory. A failed nowait read forced uptodate in raid1_end_read_request() completes into the attacker's own O_DIRECT buffers.\nI:H - When one raid1/raid10 clone succeeds and another returns BLK_STS_AGAIN, raid1_should_handle_error() sets ignore_error, raid1_end_write_request() still sets R1BIO_Uptodate, and raid_end_bio_io() reports success while mirrors hold different data and real member failures are not recorded as bad blocks.\nA:H - raid5 make_discard_request() returned without bio_endio() on REQ_NOWAIT, hanging the discard bio. Ignored member failures also leave a disk In_sync after a nowait EAGAIN, so a later loss of the up-to-date mirror makes diverged sectors unrecoverable and can take the array/filesystem offline."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/md-bitmap.c", "drivers/md/md-bitmap.h", "drivers/md/md-linear.c", "drivers/md/md-llbitmap.c", "drivers/md/md.c", "drivers/md/raid0.c", "drivers/md/raid1-10.c", "drivers/md/raid1.c", "drivers/md/raid10.c", "drivers/md/raid5.c"], "versions": [{"version": "f51d46d0e7cb5b8494aa534d276a9d8915a2443d", "lessThan": "ffcc9ea4e4d121c78aef6654a1577aa7d120774d", "status": "affected", "versionType": "git"}, {"version": "f51d46d0e7cb5b8494aa534d276a9d8915a2443d", "lessThan": "9bb9504e2d8f3d22ef12d51c333dd499f402dc8f", "status": "affected", "versionType": "git"}, {"version": "f51d46d0e7cb5b8494aa534d276a9d8915a2443d", "lessThan": "3fe5b7c9fb72ccc29bfd0f955b124892af7e3674", "status": "affected", "versionType": "git"}, {"version": "39db562b3fedb93978a7e42dd216b306740959f8", "status": "affected", "versionType": "git"}, {"version": "5.15.111", "lessThan": "5.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/md-bitmap.c", "drivers/md/md-bitmap.h", "drivers/md/md-linear.c", "drivers/md/md-llbitmap.c", "drivers/md/md.c", "drivers/md/raid0.c", "drivers/md/raid1-10.c", "drivers/md/raid1.c", "drivers/md/raid10.c", "drivers/md/raid5.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.111"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ffcc9ea4e4d121c78aef6654a1577aa7d120774d"}, {"url": "https://git.kernel.org/stable/c/9bb9504e2d8f3d22ef12d51c333dd499f402dc8f"}, {"url": "https://git.kernel.org/stable/c/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674"}], "title": "md: remove REQ_NOWAIT support from raid1/10/456", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/md/md-bitmap.c", "drivers/md/md-bitmap.h", "drivers/md/md-linear.c", "drivers/md/md-llbitmap.c", "drivers/md/md.c", "drivers/md/raid0.c", "drivers/md/raid1-10.c", "drivers/md/raid1.c", "drivers/md/raid10.c", "drivers/md/raid5.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ffcc9ea4e4d121c78aef6654a1577aa7d120774d", "status": "affected", "version": "f51d46d0e7cb5b8494aa534d276a9d8915a2443d", "versionType": "git"}, {"lessThan": "9bb9504e2d8f3d22ef12d51c333dd499f402dc8f", "status": "affected", "version": "f51d46d0e7cb5b8494aa534d276a9d8915a2443d", "versionType": "git"}, {"lessThan": "3fe5b7c9fb72ccc29bfd0f955b124892af7e3674", "status": "affected", "version": "f51d46d0e7cb5b8494aa534d276a9d8915a2443d", "versionType": "git"}, {"status": "affected", "version": "39db562b3fedb93978a7e42dd216b306740959f8", "versionType": "git"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.111", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/md/md-bitmap.c", "drivers/md/md-bitmap.h", "drivers/md/md-linear.c", "drivers/md/md-llbitmap.c", "drivers/md/md.c", "drivers/md/raid0.c", "drivers/md/raid1-10.c", "drivers/md/raid1.c", "drivers/md/raid10.c", "drivers/md/raid5.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: remove REQ_NOWAIT support from raid1/10/456\n\nREQ_NOWAIT support in md personalities that can block internally is\nfundamentally incomplete. While reads can avoid some blocking paths,\nwrite requests can still encounter cases where one mirror succeeds while\nanother returns -EAGAIN. At that point md cannot distinguish queue\npressure from a real device failure, so it can neither record a bad\nblock nor safely retry the write without REQ_NOWAIT, leaving mirrors\nwith divergent data.\n\nRather than continue advertising REQ_NOWAIT support for personalities\nthat cannot implement it correctly, remove it from raid1, raid10 and\nraid456. Keep REQ_NOWAIT for linear and raid0, which only remap bios to\ntheir underlying devices; stacked limits will still clear the feature if\nany component device lacks REQ_NOWAIT support."}], "id": "CVE-2026-90401", "lastModified": "2026-10-19T09:19:34.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-17T17:17:39.877", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9bb9504e2d8f3d22ef12d51c333dd499f402dc8f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ffcc9ea4e4d121c78aef6654a1577aa7d120774d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}