CVE-2026-43271 md-cluster: fix NULL pointer dereference in process_metadata_update
A race condition in the Linux kernel's md-cluster module causes a NULL pointer dereference, leading to a kernel panic and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43271?
CVE-2026-43271 is a medium-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
md-cluster: fix NULL pointer dereference in process_metadata_update
The function process_metadata_update() blindly dereferences the 'thread' pointer (acquired via rcu_dereference_protected) within the wait_event() macro.
While the code comment states "daemon thread must exist", there is a valid race condition window during the MD array startup sequence (md_run):
1. bitmap_load() is called, which invokes md_cluster_ops->join(). 2. join() starts the "cluster_recv" thread (recv_daemon). 3. At this point, recv_daemon is active and processing messages. 4. However, mddev->thread (the main MD thread) is not initialized until later in md_run().
If a METADATA_UPDATED message is received from a remote node during this specific window, process_metadata_update() will be called while mddev->thread is still NULL, leading to a kernel panic.
To fix this, we must validate the 'thread' pointer. If it is NULL, we release the held lock (no_new_dev_lockres) and return early, safely ignoring the update request as the array is not yet fully ready to process it.
Weakness: CWE-476
Which versions are affected by CVE-2026-43271?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43271?
Apply the vendor's patch.
Is CVE-2026-43271 being exploited?
There is no known exploitation of CVE-2026-43271 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43271, DEBIAN-CVE-2026-43271, GHSA-3r8g-c43c-9gw2, ROOT-OS-DEBIAN-11-CVE-2026-43271, ROOT-OS-DEBIAN-12-CVE-2026-43271, ROOT-OS-UBUNTU-2204-CVE-2026-43271 and 2 more.