Linux Kernel CVE-2026-90401

Exploitation requires: (1) the storage volume is a Linux md software-RAID array using the raid1, raid10, or raid456 personality (linear and raid0 are unaffected); (2) a local process submitting non-blocking write I/O via REQ_NOWAIT - i.e. RWF_NOWAIT with preadv2/pwritev2 or io_uring nowait submissions; (3) the array experiencing internal queue pressure such that at least one mirror returns -EAGAIN while another completes; and (4) a multi-device write path where per-mirror results can diverge. Limiting factors: it needs local access to issue the I/O (AV:L), is a timing/queue-pressure race rather than a deterministic condition, does not affect arrays not using nowait I/O, and yields silent data divergence rather than direct code execution or disclosure.

The vendor CVSS is 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), correctly local-only (AV:L) and unauthenticated-not-applicable - it requires a local, low-privileged process (PR:L) issuing non-blocking I/O. There is no EPSS score, no CISA KEV listing, and no public exploit provided, so exploitation status is: no public exploit identified at time of analysis. Critically, this is not a classic attacker-driven memory-safety flaw - it is a data-integrity/correctness defect in Linux md RAID. REQ_NOWAIT (RWF_NOWAIT / io_uring nowait) writes to raid1/raid10/raid456 arrays can have one mirror succeed while another returns -EAGAIN under queue pressure; md cannot distinguish transient pressure from real device failure, so it can neither record a bad block nor safely retry, leaving mirrors with divergent data. I mostly agree with I:H (silent divergent-mirror corruption is a genuine integrity impact) but consider AC:L overstated - triggering the divergence requires the coincidence of nowait writes AND internal queue pressure AND a partial per-mirror -EAGAIN, which is a race/timing condition (AC:H is more honest). A:H is also overstated: the bug corrupts/diverges data rather than reliably crashing or hanging the system. Net, this is a real-but-narrow reliability/integrity issue (my adjusted ~5.5-6.0), not a widely-weaponizable priority. The 'Information Disclosure' tag is inconsistent with the vector's C:N and should be treated as mislabeled.

On a server whose data volume is a raid1/raid10/raid456 md array, an application (or io_uring workload) issues RWF_NOWAIT write requests while the array is under I/O queue pressure. One mirror completes the write while another returns -EAGAIN, and because md cannot safely retry or record a bad block, the mirrors are left with divergent contents - silent data corruption that surfaces on a later read or resync. No public exploit code is provided; realistic occurrence is a stability/data-integrity fault rather than a targeted attack, and it needs local access to submit the nowait I/O.