HIGH
md Nowait Corruption
CVE-2026-90401
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
KernelScan AI5.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: md: remove REQ_NOWAIT support from raid1/10/456 REQ_NOWAIT support in md personalities that can block internally is fundamentally incomplete. While reads can avoid some blocking paths, write requests can still encounter cases where one mirror succeeds while another returns -EAGAIN. At that point md cannot distinguish queue pressure from a real device failure, so it can neither record a bad block nor safely retry the write without REQ_NOWAIT, leaving mirrors with divergent data. Rather than continue advertising REQ_NOWAIT support for personalities that cannot implement it correctly, remove it from raid1, raid10 and raid456. Keep REQ_NOWAIT for linear and raid0, which only remap bios to their underlying devices; stacked limits will still clear the feature if any component device lacks REQ_NOWAIT support.
02KernelScan AI Analysis
Risk summary
RAID 1/10/456 arrays advertised support for REQ_NOWAIT I/O but could not handle it correctly for mirrored writes. When one mirror accepts a write and another returns a would-block error, the array cannot distinguish queue pressure from a real device failure, leaving mirrors with silently divergent data. Any local user with write access to an affected md device can trigger this through io_uring or other nowait I/O paths.
Vulnerability analysis
The RAID 1, 10, and 456 personalities in the md driver advertised REQ_NOWAIT support, but their internal blocking paths made correct handling impossible for mirrored writes. When a nowait write is split across mirrors and one mirror succeeds while another cannot complete without blocking, the error-handling logic cannot tell temporary queue pressure from an actual disk failure — so it neither records a bad block nor retries the write, causing the mirrors to diverge silently with no record of the inconsistency. The fix removes REQ_NOWAIT support entirely from these personalities so that writes always block when needed, preserving mirror consistency; REQ_NOWAIT is retained only for linear and raid0, which simply remap I/O to underlying devices without internal blocking. The vulnerable path is reachable locally by any process that can submit nowait I/O (e.g. via io_uring) to a configured raid1, raid10, or raid456 block device, requiring no special privileges beyond write access to the device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15.111 | 5.16 | ffcc9ea4e4d1 |
| 6.18 | — | 6.18.57 | 9bb9504e2d8f |
| 7.2 | — | 7.2.6 | 3fe5b7c9fb72 |
| mainline | — | 7.3 | — |