CVE-2026-90400

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md: recheck spare changes before starting sync

remove_spares() and remove_and_add_spares() modify the array's rdev

configuration. These operations are only safe after the array has been

suspended.

md_start_sync() checks whether spare configuration changes are needed

before taking reconfig_mutex. However, the rdev state can change before

the mutex is acquired, so the initial check can become stale. In that

case, md_choose_sync_action() may remove or replace rdevs while normal

I/O is still accessing them.

The race can occur as follows:

raid10d Worker Normal IO

____________ _______________________ ______________________

raid10_write_request()

wait_blocked_dev()

set Blocked

set Faulty

Skip Faulty rdev

r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References