CVE-2026-46050

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix deadlock with check operation and nowait requests

When an array check is running it will raise the barrier at which point

normal requests will become blocked and increment the nr_pending value to

signal there is work pending inside of wait_barrier(). NOWAIT requests

do not block and so will return immediately with an error, and additionally

do not increment nr_pending in wait_barrier(). Upstream change commit

43806c3d5b9b ("raid10: cleanup memleak at raid10_make_request") added a

call to raid_end_bio_io() to fix a memory leak when NOWAIT requests hit

this condition. raid_end_bio_io() eventually calls allow_barrier() and

it will unconditionally do an atomic_dec_and_test(&conf->nr_pending) even

though the corresponding increment on nr_pending didn't happen in the

NOWAIT case.

This can be easily seen by starting a check operation while an application

is doing nowait IO on the same array. This results in

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References