Linux Kernel EUVD-2026-32433

The affected code resides in drivers/md/raid5.c within the Linux kernel's software RAID subsystem (md - multiple devices). The vulnerability manifests in retry_aligned_read(), the function responsible for retrying aligned block I/O requests that were deferred due to stripe busy conditions. CWE-667 (Improper Locking) captures the root cause: when retry_aligned_read() encounters an overlapping stripe, it calls raid5_release_stripe(), which enqueues the stripe onto the lockless released_stripes llist. On the next iteration of the raid5d kernel worker thread, release_stripe_list() correctly drains the stripe onto handle_list because STRIPE_HANDLE is set. However, retry_aligned_read() executes before handle_active_stripes() within the same raid5d loop and calls find_get_stripe() followed by list_del_init(), removing the stripe from handle_list. This creates a perpetual starvation condition: handle_stripe() never receives the stripe to resolve the overlap, raid5d loops indefinitely, and the kernel soft-lockup watchdog fires. The fix redirects the release path to __release_stripe() with a temp_inactive_list, bypassing the released_stripes llist and allowing raid5d to exit its loop. CPE coverage confirms the affected platform as cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across seven tracked stable series.