Linux Kernel EUVD-2026-27666

Exploitation requires all of the following: (1) the md-cluster kernel module must be loaded and active on the target system, meaning the host must be configured for clustered Linux software RAID using mdadm in cluster mode - single-node MD RAID or systems without md-cluster are entirely unaffected; (2) the attacker must have local low-privilege access to the system (PR:L per CVSS); (3) a cluster peer node must be reachable and capable of sending a METADATA_UPDATED DLM message to the target; (4) that message must arrive during the precise initialization window in md_run() after bitmap_load() but before mddev->thread assignment. The race window is transient and sub-second in duration, making unassisted reliable triggering difficult. No special kernel build flags or non-default compilation options are required beyond md-cluster being present and loaded.

The CVSS base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately captures the local-only vector and pure availability impact (kernel panic). However, AC:L is arguably optimistic given the timing-dependent race window, which requires a remote cluster peer to transmit a METADATA_UPDATED message during a specific sub-second initialization interval - a condition more consistent with AC:H. EPSS at 0.02% (5th percentile) and the absence of a CISA KEV listing corroborate that real-world exploitation is very unlikely. There is no public exploit at time of analysis. Practical risk is further constrained to systems that have md-cluster compiled and actively configured for clustered MD RAID, a niche deployment pattern found primarily in HPC and specialized enterprise storage environments. For teams operating such configurations, this is a credible local DoS vector worth patching promptly; for the vast majority of Linux deployments without md-cluster, the effective risk is zero.

A local user with low-privilege access on a host running a clustered MD RAID array triggers or observes an MD array startup sequence via mdadm. A coordinated or opportunistic METADATA_UPDATED cluster message from a peer node arrives during the brief window between bitmap_load() completing and mddev->thread being initialized in md_run(). The NULL dereference in process_metadata_update() causes an immediate kernel panic, crashing the host. No public proof-of-concept exists; the narrow, timing-dependent race window makes reliable exploitation difficult in practice.