CVE-2026-90275

In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set array_frozen in raid1_takeover() raid1_takeover() sets conf->array_frozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once _wait_barrier() sees it stuck at 1. This used to be harmless: level_store() called mddev_resume() right after pers->run(), which called raid1_quiesce(mddev, 0) and cleared array_frozen back to 0 regardless of what raid1_takeover() set. Commit b39f35ebe86d ("md: don't quiesce in mddev_suspend()") removed that quiesce(mddev, 0) call, so the pre-set now sticks. setup_conf() already zero-initializes the new r1conf via kzalloc, so just don't set array_frozen here. Same class of bug as commit 892da88d1cd9 ("md/raid10: fix a 'conf->barrier' leakage in raid10_takeover()"), also triggered by b39f35ebe86d.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/668d99ba47210ab6ceb18f1cf022c0accca7e3bb
https://git.kernel.org/stable/c/b6ec4bf1ec4446c0213c08ea493e48e6b83cd1af
https://git.kernel.org/stable/c/c57ec2749ee03cace564eec7bb37c89dc3d8d47b
https://git.kernel.org/stable/c/dc386aa0ac0a3ec06c9a3ea9b064b073fb72a916
https://git.kernel.org/stable/c/f9cdb5bb8efbf401e84d850828271af87e6be2dc

Configurations

No configuration.

History

17 Sep 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 17:17

Updated : 2026-09-17 17:17

NVD link : CVE-2026-90275

Mitre link : CVE-2026-90275

CVE.ORG link : CVE-2026-90275

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-90275", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b39f35ebe86d88788d85f61e83c81c308cb76727", "lessThan": "668d99ba47210ab6ceb18f1cf022c0accca7e3bb", "versionType": "git"}, {"status": "affected", "version": "b39f35ebe86d88788d85f61e83c81c308cb76727", "lessThan": "c57ec2749ee03cace564eec7bb37c89dc3d8d47b", "versionType": "git"}, {"status": "affected", "version": "b39f35ebe86d88788d85f61e83c81c308cb76727", "lessThan": "f9cdb5bb8efbf401e84d850828271af87e6be2dc", "versionType": "git"}, {"status": "affected", "version": "b39f35ebe86d88788d85f61e83c81c308cb76727", "lessThan": "b6ec4bf1ec4446c0213c08ea493e48e6b83cd1af", "versionType": "git"}, {"status": "affected", "version": "b39f35ebe86d88788d85f61e83c81c308cb76727", "lessThan": "dc386aa0ac0a3ec06c9a3ea9b064b073fb72a916", "versionType": "git"}], "programFiles": ["drivers/md/raid1.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"status": "unaffected", "version": "0", "lessThan": "6.6", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.157", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.110", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.52", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.6", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/md/raid1.c"], "defaultStatus": "affected"}]}], "published": "2026-09-17T17:17:24.130", "references": [{"url": "https://git.kernel.org/stable/c/668d99ba47210ab6ceb18f1cf022c0accca7e3bb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b6ec4bf1ec4446c0213c08ea493e48e6b83cd1af", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c57ec2749ee03cace564eec7bb37c89dc3d8d47b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dc386aa0ac0a3ec06c9a3ea9b064b073fb72a916", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f9cdb5bb8efbf401e84d850828271af87e6be2dc", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: don't set array_frozen in raid1_takeover()\n\nraid1_takeover() sets conf->array_frozen = 1 on the newly-allocated\nr1conf and nothing ever clears it, so every I/O to the array stalls\npermanently once _wait_barrier() sees it stuck at 1.\n\nThis used to be harmless: level_store() called mddev_resume() right\nafter pers->run(), which called raid1_quiesce(mddev, 0) and cleared\narray_frozen back to 0 regardless of what raid1_takeover() set. Commit\nb39f35ebe86d (\"md: don't quiesce in mddev_suspend()\") removed that\nquiesce(mddev, 0) call, so the pre-set now sticks.\n\nsetup_conf() already zero-initializes the new r1conf via kzalloc, so\njust don't set array_frozen here.\n\nSame class of bug as commit 892da88d1cd9 (\"md/raid10: fix a\n'conf->barrier' leakage in raid10_takeover()\"), also triggered by\nb39f35ebe86d."}], "lastModified": "2026-09-17T17:17:24.130", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}