CVE-2026-43309

{"id": "CVE-2026-43309", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43309", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:35:03.007086Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0dd84b319352bb8ba64752d4e45396d8b13e6018", "lessThan": "63054027d95200b04f3cf624faa7817e0555d56a", "versionType": "git"}, {"status": "affected", "version": "0dd84b319352bb8ba64752d4e45396d8b13e6018", "lessThan": "24783dd06de870d646c25207bae186f78195f912", "versionType": "git"}, {"status": "affected", "version": "0dd84b319352bb8ba64752d4e45396d8b13e6018", "lessThan": "338378dfffbdbb8d37a18f0a0c0358812671f91e", "versionType": "git"}, {"status": "affected", "version": "0dd84b319352bb8ba64752d4e45396d8b13e6018", "lessThan": "cefcb9297fbdb6d94b61787b4f8d84f55b741470", "versionType": "git"}, {"status": "affected", "version": "1678ca35b80a94d474fdc31e2497ce5d7ed52512", "versionType": "git"}, {"status": "affected", "version": "690b5c90fd2d81fd1d2b6110fa36783232f6dce2", "versionType": "git"}, {"status": "affected", "version": "8e7fb19f1a744fd34e982633ced756fee0498ef7", "versionType": "git"}, {"status": "affected", "version": "a5a58fab556bfe618b4c9719eb85712d78c6cb10", "versionType": "git"}, {"status": "affected", "version": "661c01b2181d9413c799127f13143583b69f20fd", "versionType": "git"}, {"status": "affected", "version": "f42a9819ba84bed2e609a4dff56af37063dcabdc", "versionType": "git"}, {"status": "affected", "version": "4.14.292", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.19.257", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.212", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "5.10.140", "lessThan": "5.11", "versionType": "semver"}, {"status": "affected", "version": "5.15.64", "lessThan": "5.16", "versionType": "semver"}, {"status": "affected", "version": "5.19.6", "lessThan": "5.20", "versionType": "semver"}], "programFiles": ["drivers/md/md.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"status": "unaffected", "version": "0", "lessThan": "6.0", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/md/md.c"], "defaultStatus": "affected"}]}], "published": "2026-05-08T14:16:38.250", "references": [{"url": "https://git.kernel.org/stable/c/24783dd06de870d646c25207bae186f78195f912", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/338378dfffbdbb8d37a18f0a0c0358812671f91e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/63054027d95200b04f3cf624faa7817e0555d56a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cefcb9297fbdb6d94b61787b4f8d84f55b741470", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd raid: fix hang when stopping arrays with metadata through dm-raid\n\nWhen using device-mapper's dm-raid target, stopping a RAID array can cause\nthe system to hang under specific conditions.\n\nThis occurs when:\n\n- A dm-raid managed device tree is suspended from top to bottom\n (the top-level RAID device is suspended first, followed by its\n underlying metadata and data devices)\n\n- The top-level RAID device is then removed\n\nRemoving the top-level device triggers a hang in the following sequence:\nthe dm-raid destructor calls md_stop(), which tries to flush the\nwrite-intent bitmap by writing to the metadata sub-devices. However, these\ndevices are already suspended, making them unable to complete the write-intent\noperations and causing an indefinite block.\n\nFix:\n\n- Prevent bitmap flushing when md_stop() is called from dm-raid\ndestructor context\n and avoid a quiescing/unquescing cycle which could also cause I/O\n\n- Still allow write-intent bitmap flushing when called from dm-raid\nsuspend context\n\nThis ensures that RAID array teardown can complete successfully even when the\nunderlying devices are in a suspended state.\n\nThis second patch uses md_is_rdwr() to distinguish between suspend and\ndestructor paths as elaborated on above."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nmd raid: corrige el cuelgue al detener arreglos con metadatos a trav\u00e9s de dm-raid\n\nAl usar el objetivo dm-raid de device-mapper, detener un arreglo RAID puede provocar que el sistema se cuelgue bajo condiciones espec\u00edficas.\n\nEsto ocurre cuando:\n\n- Un \u00e1rbol de dispositivos gestionado por dm-raid se suspende de arriba a abajo (el dispositivo RAID de nivel superior se suspende primero, seguido de sus dispositivos subyacentes de metadatos y datos)\n\n- El dispositivo RAID de nivel superior se elimina a continuaci\u00f3n\n\nLa eliminaci\u00f3n del dispositivo de nivel superior desencadena un cuelgue en la siguiente secuencia: el destructor de dm-raid llama a md_stop(), que intenta vaciar el mapa de bits de intenci\u00f3n de escritura escribiendo en los subdispositivos de metadatos. Sin embargo, estos dispositivos ya est\u00e1n suspendidos, lo que les impide completar las operaciones de intenci\u00f3n de escritura y provoca un bloqueo indefinido.\n\nSoluci\u00f3n:\n\n- Evitar el vaciado del mapa de bits cuando se llama a md_stop() desde el contexto del destructor de dm-raid y evitar un ciclo de quiescencia/desquiescencia que tambi\u00e9n podr\u00eda causar E/S\n\n- Seguir permitiendo el vaciado del mapa de bits de intenci\u00f3n de escritura cuando se llama desde el contexto de suspensi\u00f3n de dm-raid\n\nEsto asegura que el desmantelamiento del arreglo RAID pueda completarse con \u00e9xito incluso cuando los dispositivos subyacentes est\u00e1n en un estado suspendido.\n\nEste segundo parche utiliza md_is_rdwr() para distinguir entre las rutas de suspensi\u00f3n y de destructor, como se explic\u00f3 anteriormente."}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90B7818C-A8A5-4C02-A732-1CDB5825A096", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.292"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC49E974-39F0-4EAB-AA56-2136CE9885A8", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.257"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FF42D15-4929-4BA3-A853-6ED272405AD4", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.212"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61324615-2233-4AFB-B3E2-0703FED36D4A", "versionEndExcluding": "5.11", "versionStartIncluding": "5.10.140"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B81924EA-65D3-4820-9B92-35D59FC2A466", "versionEndExcluding": "5.16", "versionStartIncluding": "5.15.64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E53B030-2C91-45B9-91A0-63E897460E68", "versionEndExcluding": "6.0", "versionStartIncluding": "5.19.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03E689D3-2167-43C7-81EB-609E36C5A388", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.0.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BE551E5-89CF-47A8-9B26-03CE727FBA37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A46498B3-78E1-4623-AAE1-94D29A42BE4E"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8446E87-F5F6-41CA-8201-BAE0F0CA6DD9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E5FB72F-67CE-43CC-83FE-541604D98182"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A0A7397-F5F8-4753-82DC-9A11288E696D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6DE049A-ABA8-41DD-988C-8C088358EE9B"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}