EUVD-2026-59521
GHSA-mr8x-hvpc-q7pw
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local kernel RAID error path requires concurrent memory pressure and I/O failure (AC:H, AV:L); no confidentiality or integrity impact, only availability.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
md/raid1,raid10: fix error-path detection with md_cloned_bio()
Detect the error path using md_cloned_bio() instead of relying on r1_bio in raid1 or r10_bio->read_slot in raid10, which may be NULL or -1 after splitting and resubmitting a failed bio.
As a result, the error path may not be recognized and memory allocations can incorrectly use GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), which can lead to a deadlock under memory pressure.
AnalysisAI
Deadlock vulnerability in the Linux kernel md/raid1 and md/raid10 drivers can freeze systems running software RAID1 or RAID10 under concurrent memory pressure. The flaw causes incorrect GFP flag selection during block I/O error recovery - the kernel uses GFP_NOIO instead of GFP_NOIO|__GFP_HIGH after a failed bio is split and resubmitted, starving memory reclaim of emergency reserves and causing a kernel deadlock. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All three of the following conditions must be present simultaneously: (1) the Linux kernel must be running md/raid1 or md/raid10 - Linux software RAID in RAID-1 or RAID-10 mode specifically, not hardware RAID controllers or other RAID levels; (2) a storage device in the array must return an I/O error that triggers bio splitting and resubmission in the MD layer; and (3) the host must be under sufficient memory pressure at the moment of error recovery that a GFP_NOIO allocation cannot be fulfilled from normal memory pools. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) is almost certainly a metadata error - this vulnerability involves strictly local kernel state within software RAID error-recovery paths, not a remotely exploitable network service, and treating it as zero-authentication network-accessible would significantly misallocate remediation effort. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A storage device in a Linux software RAID1 array begins returning I/O errors - for example, due to a failing disk during a high-memory-utilization database compaction job. The kernel md layer splits the failed bio and resubmits it, but the r1_bio pointer is now NULL, causing the error-path check to silently pass as non-error. … |
| Remediation | The primary fix is to upgrade to Linux kernel 7.1.5 (stable series) or 7.2-rc1 (mainline), both of which incorporate the corrected md_cloned_bio() error-path detection logic. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems using software RAID1 or RAID10 drivers, documenting production environment status and business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today