Skip to main content

Linux Kernel CVE-2026-53123

| EUVDEUVD-2026-38991 MEDIUM
2026-06-24 Linux GHSA-26h7-ghcj-373h
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H reflects the narrow precondition window (active reshape plus concurrent suspend); all other metrics align with the provided vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:11 vuln.today
CVSS changed
Jul 23, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

md: wake raid456 reshape waiters before suspend

During raid456 reshape, direct IO across the reshape position can sleep in raid5_make_request() waiting for reshape progress while still holding an active_io reference. If userspace then freezes reshape and writes md/suspend_lo or md/suspend_hi, mddev_suspend() kills active_io and waits for all in-flight IO to drain.

This can deadlock: the IO needs reshape progress to continue, but the reshape thread is already frozen, so the active_io reference is never dropped and suspend never completes.

raid5_prepare_suspend() already wakes wait_for_reshape for dm-raid. Do the same for normal md suspend when reshape is already interrupted, so waiting raid456 IO can abort, drop its reference, and let suspend finish.

The mdadm test tests/25raid456-reshape-deadlock reproduces the hang.

AnalysisAI

Deadlock in the Linux kernel's md/raid456 subsystem during array reshape allows a local low-privileged user to hang the system indefinitely. When direct I/O spans the reshape position in a RAID 4/5/6 array, the I/O blocks in raid5_make_request() holding an active_io reference while waiting for reshape progress. If an administrator concurrently freezes the reshape and writes to md/suspend_lo or md/suspend_hi, mddev_suspend() deadlocks: it waits for active_io to drain, but the blocked I/O requires reshape progress that the frozen reshape thread can never provide. Exploitation requires a very specific confluence of conditions and no public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.17% (7th percentile) confirms low real-world exploitation probability.

Technical ContextAI

The Linux kernel's md (multiple-device) subsystem manages software RAID arrays. The raid456 module handles RAID levels 4, 5, and 6, which use distributed parity across drives and support online reshape operations (changing stripe geometry, chunk size, or drive count). During reshape, raid5_make_request() must handle I/O requests whose logical addresses straddle the current reshape position: such requests sleep on the wait_for_reshape wait queue while retaining an active_io reference - a reference count that mddev_suspend() must see reach zero before it can safely quiesce the device. The sysfs attributes md/suspend_lo and md/suspend_hi allow userspace to define a suspended region; writing to them invokes mddev_suspend(), which calls active_io_release() and then waits synchronously. The fix, mirroring the existing raid5_prepare_suspend() behavior already in place for dm-raid, ensures that the normal md suspend path also wakes wait_for_reshape waiters when reshape is already interrupted, allowing pending I/O to abort cleanly and release their references. No CWE is assigned in NVD data, but this is a classic CWE-833 (Deadlock) pattern. CPE identifies the affected product as cpe:2.3:a:linux:linux.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel: 6.12.91, 6.18.33, 7.0.10, or 7.1, available from https://git.kernel.org/stable/c/8b6a72420821e6da2cab6a69d5233500d2698b93 and related stable commits. Ubuntu users should apply the updates referenced in USN-8568-1, USN-8567-1, and USN-8566-1 (https://ubuntu.com/security/notices/USN-8568-1). As a workaround where patching is not immediately possible, administrators can avoid writing to md/suspend_lo or md/suspend_hi on arrays that have an active reshape in progress, or ensure any reshape is fully completed or cleanly stopped (not merely frozen/interrupted) before invoking mddev_suspend(). Alternatively, restricting direct I/O (O_DIRECT) to the md device during reshape windows eliminates the blocking I/O condition. These workarounds require operational discipline rather than configuration change and have the trade-off of limiting normal storage management flexibility.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53123 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy