CVE-2026-53123

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md: wake raid456 reshape waiters before suspend

During raid456 reshape, direct IO across the reshape position can sleep

in raid5_make_request() waiting for reshape progress while still

holding an active_io reference. If userspace then freezes reshape and

writes md/suspend_lo or md/suspend_hi, mddev_suspend() kills active_io

and waits for all in-flight IO to drain.

This can deadlock: the IO needs reshape progress to continue, but the

reshape thread is already frozen, so the active_io reference is never

dropped and suspend never completes.

raid5_prepare_suspend() already wakes wait_for_reshape for dm-raid. Do

the same for normal md suspend when reshape is already interrupted, so

waiting raid456 IO can abort, drop its reference, and let suspend

finish.

The mdadm test tests/25raid456-reshape-deadlock reproduces the hang.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References