Menu

Star on GitHub · 3.2k

CVE-2026-43309

5.5 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid When using device-mapper's dm-raid target, stopping a RAID…

Published May 8, 2026EPSS 0.16%

Overview

CVE-2026-43309 is a medium-severity vulnerability. It was published on May 8, 2026 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

md raid: fix hang when stopping arrays with metadata through dm-raid

When using device-mapper's dm-raid target, stopping a RAID array can cause

the system to hang under specific conditions.

This occurs when:

- A dm-raid managed device tree is suspended from top to bottom

(the top-level RAID device is suspended first, followed by its

underlying metadata and data devices)

- The top-level RAID device is then removed

Removing the top-level device triggers a hang in the following sequence:

the dm-raid destructor calls md_stop(), which tries to flush the

write-intent bitmap by writing to the metadata sub-devices. However, these

devices are already suspended, making them unable to complete the write-intent

operations and causing an indefinite block.

Fix:

- Prevent bitmap flushing when md_stop() is called from dm-raid

destructor context

and avoid a quiescing/unquescing cycle which could also cause I/O

- Still

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Frequently asked questions

What is CVE-2026-43309?

CVE-2026-43309 is a medium-severity vulnerability. It was published on May 8, 2026 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2026-43309?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-43309?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-43309?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-43309 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2026

View all