CVE-2026-90275 md/raid1: don't set array_frozen in raid1_takeover()
A local attacker with high privileges can cause a permanent denial of service in Linux RAID1 arrays by triggering a takeover operation that leaves the array frozen.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90275?
CVE-2026-90275 is a denial of service vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
md/raid1: don't set array_frozen in raid1_takeover()
raid1_takeover() sets conf->array_frozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once _wait_barrier() sees it stuck at 1.
This used to be harmless: level_store() called mddev_resume() right after pers->run(), which called raid1_quiesce(mddev, 0) and cleared array_frozen back to 0 regardless of what raid1_takeover() set. Commit b39f35ebe86d ("md: don't quiesce in mddev_suspend()") removed that quiesce(mddev, 0) call, so the pre-set now sticks.
setup_conf() already zero-initializes the new r1conf via kzalloc, so just don't set array_frozen here.
Same class of bug as commit 892da88d1cd9 ("md/raid10: fix a 'conf->barrier' leakage in raid10_takeover()"), also triggered by b39f35ebe86d.
Which versions are affected by CVE-2026-90275?
How do I fix CVE-2026-90275?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-90275 being exploited?
There is no known exploitation of CVE-2026-90275 in the wild and no public exploit code.
Sources
Also known as AZL-102684, BELL-CVE-2026-90275, DEBIAN-CVE-2026-90275, GHSA-c82r-j325-qwcg, UBUNTU-CVE-2026-90275.