CVE-2024-26755

What it actually does

Race condition in md RAID reshape handling allows deadlock when an interrupted reshape, spare disk addition (WantReplacement), and cross-reshape-position IO occur concurrently, causing md_start_sync suspension to wait on IO that itself waits on reshape progress.

Why it matters to the business

Linux systems using software RAID (especially raid456) can experience storage subsystem hangs during array maintenance or recovery, leading to loss of data availability and requiring reboots or manual intervention; prevalence in Linux distributions makes broad fleet impact possible.

How an attack unfolds

An attacker with sufficient privileges to interrupt a reshape, mark a disk for replacement, add a spare, and issue IO spanning the reshape boundary can trigger the deadlock; the scenario was identified via code review and has not been observed in the wild.

How to fix it

Upgrade the Linux kernel to version 6.7.7 or later, or apply the fix from commit 60d6130d0ac1d883ed93c2a1e10aadb60967fd48 in the stable git tree; avoid reshape operations on vulnerable kernels until patched.

How to confirm the fix worked

Confirm kernel version is at least 6.7.7; verify the md.c source contains the updated md_start_sync logic that skips suspension for interrupted reshape; test reshape + spare addition + cross-position IO in a lab environment.

Typical attack path

1. Interrupt an ongoing md reshape operation
2. Set WantReplacement on a member disk and add a spare
3. Issue IO that straddles the current reshape position
4. Allow md_start_sync to attempt conf update and call mddev_suspend
5. Observe mutual wait between IO completion and reshape progress

How to detect it

Review kernel logs for hung tasks or deadlock warnings involving md_sync or reshape; examine dmesg and syslog for mddev_suspend calls during active reshape; no public exploitation artifacts exist.

What your security team should do

• Prioritize kernel updates on all systems using md/RAID within 30 days
• Monitor for kernel oops or hung-task messages related to md during array recovery
• Restrict unprivileged access to mdadm and block device operations where possible