{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-89558", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.724Z", "datePublished": "2026-09-11T19:44:30.588Z", "dateUpdated": "2026-10-19T08:48:51.700Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:48:51.700Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix still_degraded being inverted in raid10_sync_request()\n\nCommit fe6a19d40ceb (\"md/md-bitmap: merge md_bitmap_start_sync() into\nbitmap_operations\") converted still_degraded from int to bool, but\ninverted the assignment in the loop that checks whether the array will\nstill be degraded after the current device is recovered:\n\"still_degraded = 1\" became \"still_degraded = false\".\n\nAs a result, recovering a device while another mirror is still missing\ncalls md_bitmap_start_sync() with degraded == false, which clears bitmap\nbits that the still-missing device needs. When that device is re-added,\nits bitmap-based recovery finds the bits already cleared and skips every\nregion written while the array was degraded, so it is marked In_sync\nwhile holding stale data: silent corruption.\n\nReproducer (raid10 near=2, 4 disks, internal bitmap):\n - fail and remove one disk of each mirror pair\n - write to the degraded array\n - re-add both disks and let recovery finish\n - \"check\" reports mismatch_cnt=262272 after 256 MiB of degraded\n writes and file contents differ; the second disk's \"recovery\"\n completes in milliseconds because everything is skipped\n\nThe same conversion in raid1 got it right (still_degraded = true).\nRestore the correct value." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - md RAID10 commonly backs NAS/SAN volumes exported over NFS, ksmbd, iSCSI, and NVMe-oF. Remote writes during dual-degraded operation dirty the write-intent bitmap, and after buggy recovery remote reads reach md_submit_bio()->raid10_read_request()->read_balance() and are served from the stale In_sync mirror without local shell access.\nAC:L - The inverted still_degraded assignment is deterministic in raid10_sync_request() whenever one member is recovered while another remains missing or Faulty. The documented fail/remove/write/re-add sequence needs no race or attacker-uncontrolled memory layout; write-intent bitmaps on RAID10 are a standard mdadm default, not a rare config.\nPR:N - Client I/O to an exported RAID10 LUN needs no Linux UID or host capability: unauthenticated iSCSI/NVMe-oF and guest NFS/SMB writes reach md_submit_bio() and later read stale mirrors. md ioctls/sysfs fail/re-add use capable(CAP_SYS_ADMIN), but hot-spare recovery and storage-protocol I/O do not, so Privileges Required is None rather than High.\nUI:N - No victim click, mount, or confirmation is required. The attacker or automated storage clients issue ordinary reads and writes; md_check_recovery() and md_start_sync() invoke raid10_sync_request() from hot-spare activation or disk re-add as kernel background work.\nS:U - Silent corruption, stale-data disclosure, and volume unavailability remain inside the host kernel and the md RAID10 array. The bug does not escape a VM, bypass an IOMMU, or otherwise cross a separate security authority.\nC:H - raid10_spare_active() sets In_sync on the re-added member while it still holds stale sectors. read_balance() then returns that disk's prior contents, including previously freed blocks that the current filesystem layout may assign to other users' or overwritten files, disclosing unauthorized data.\nI:H - md_bitmap_start_sync() is called with degraded=false, clearing NEEDED bits the still-missing mirror requires. That device is marked In_sync after skipping dirty regions; later read-modify-write of the stale data is mirrored to all copies, permanently corrupting filesystem and user data.\nA:H - Stale filesystem metadata served from the wrongly In_sync mirror drives remount-ro, XFS shutdown, or panic on errors=panic, and skipped bitmap recovery leaves dirty regions unrestored, denying availability of the RAID10 volume and any boot or data filesystems on it." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/md/raid10.c" ], "versions": [ { "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4", "status": "affected", "versionType": "git" }, { "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "0efabe6229dc683dbf6eeebd0f9fddc7971ed420", "status": "affected", "versionType": "git" }, { "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "00449d752bee9c8787f42ea1bf533a9fb17f9b6b", "status": "affected", "versionType": "git" }, { "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "47f1441b281decde6954a2fa82b4131637d685ac", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/md/raid10.c" ], "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.109" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.50" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4" }, { "url": "https://git.kernel.org/stable/c/0efabe6229dc683dbf6eeebd0f9fddc7971ed420" }, { "url": "https://git.kernel.org/stable/c/00449d752bee9c8787f42ea1bf533a9fb17f9b6b" }, { "url": "https://git.kernel.org/stable/c/47f1441b281decde6954a2fa82b4131637d685ac" } ], "title": "md/raid10: fix still_degraded being inverted in raid10_sync_request()", "x_generator": { "engine": "bippy-1.2.0" } } } }