HIGH Introduced in 4.16
md FlushUnit UAF
CVE-2026-93262
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppl_do_flush() The loop in ppl_do_flush() continues iterating after calling ppl_io_unit_finished(), touching io->pending_flushes and leading to a use-after-free. Add a break statement to stop the loop once io is freed.
02KernelScan AI Analysis
Risk summary
A use-after-free in the RAID5 Partial Parity Log (PPL) flush path can be triggered by any process writing to a filesystem backed by a RAID5 array with PPL and write-back cache enabled. The freed memory may be reused, leading to kernel memory corruption with potential for privilege escalation or denial of service. Systems without RAID5 PPL are not affected.
Vulnerability analysis
In the RAID5 write-back cache flush path, a loop counts down pending disk flushes for an I/O request and releases the request object when the count hits zero, but then keeps iterating and accesses the freed memory. The fix stops the loop immediately once the object is released. Any write to a filesystem stored on a RAID5 array with Partial Parity Logging and write-back cache enabled can reach this code; only write access to the mounted filesystem is required to trigger the flaw, although an administrator must have enabled that RAID configuration.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.16 | 5.10.270 | cf01f9413565 |
| 6.1 | 4.16 | 6.1.188 | b5123bf667ac |
| 6.18 | 4.16 | 6.18.52 | 455b56209f96 |
| mainline | 4.16 | 7.3-rc1 | 371f7a1b392e |
| 6.6 | 4.16 | 6.6.157 | e77c80670f2c |
| 7.2 | 4.16 | 7.2.6 | fcf21df7d3c5 |
| 6.12 | 4.16 | 6.12.110 | 8914c3d40870 |
| 5.15 | 4.16 | 5.15.221 | e7505842f132 |
| cip/6.12 | 4.16 | 6.12.111-cip32 | 8914c3d40870 |