CVE-2024-26756

What it actually does

A race condition in the Linux kernel MD RAID subsystem where MD_RECOVERY_RUNNING is set directly from pers->run() during interrupted reshape reassembly without guaranteeing md_do_sync() execution, preventing MD_RECOVERY_RUNNING from being cleared and causing stop_sync_thread() to hang.

Why it matters to the business

System hangs or unresponsiveness during RAID reshape and array reassembly operations on Linux storage setups, leading to operational downtime and potential need for manual intervention or reboots, with higher urgency for environments using dm-raid.

How an attack unfolds

An attacker with local privileges interrupts a reshape operation, triggers array reassembly that registers the sync thread directly, then initiates dm-raid presuspend or device removal to deadlock stop_sync_thread while recovery flags remain set; no named threat actors have been observed exploiting this.

How to fix it

Upgrade the Linux kernel to a version containing commit 13b520fb62b772e408f9b79c5fe18ad414e90417 which removes direct sync_thread registration from raid10 and raid5 and relies on md_check_recovery() instead.

How to confirm the fix worked

Verify the presence of commit 13b520fb62b772e408f9b79c5fe18ad414e90417 in the running kernel source; confirm that MD_RECOVERY_RUNNING is properly cleared after reshape interruption and that no hangs occur during lvconvert-raid-reshape tests or equivalent operations.

Typical attack path

1. Interrupt an ongoing MD reshape operation
2. Reassemble the affected RAID array
3. Trigger raid_presuspend or dm device removal
4. Observe hang in stop_sync_thread with MD_RECOVERY_RUNNING set

How to detect it

Inspect kernel stack traces for processes blocked in stop_sync_thread or md_frozen_sync_thread; check /proc/<pid>/stack and MD recovery flags for combinations of MD_RECOVERY_RUNNING, MD_RECOVERY_INTR, MD_RECOVERY_RESHAPE, and MD_RECOVERY_FROZEN during device removal or reshape operations.

What your security team should do

• Apply the fixed kernel commit or newer stable release immediately on affected systems
• Test RAID reshape, reassembly, and dm-raid suspend/resume workflows after patching
• Monitor kernel stack traces and MD recovery flags in production environments using RAID