CVE-2024-39476

What it actually does

A deadlock in md/raid5 causes raid5d() to busy-loop waiting for MD_SB_CHANGE_PENDING to clear while md_check_recovery() requires reconfig_mutex, preventing I/O issuance and consuming 100% CPU or hanging the system.

Why it matters to the business

Linux systems using software RAID5 experience storage subsystem hangs or excessive CPU usage, disrupting data availability and operations on affected kernels until patched; fixes have been available in stable releases for an extended period.

How an attack unfolds

An attacker with local access triggers RAID5 reconfiguration or recovery paths that hold reconfig_mutex while pending superblock updates, causing raid5d() to deadlock in its I/O handling loop; no confirmed in-the-wild exploitation by listed threat actors has occurred.

How to fix it

Upgrade the Linux kernel to a fixed version such as 4.19.316 or the commit b32aa95843cac6b12c2c014d40fca18aef24a347; apply the referenced fix that skips I/O issuance when MD_SB_CHANGE_PENDING remains set after md_check_recovery().

How to confirm the fix worked

Verify the running kernel version is at or above the listed fixed releases; confirm absence of the deadlock by running LVM RAID conversion tests under load and monitoring for raid5d() CPU spikes or system hangs.

Typical attack path

1. Obtain local access on a Linux system using md/raid5
2. Trigger conditions that cause md_check_recovery() to block on reconfig_mutex while MD_SB_CHANGE_PENDING remains set
3. Force raid5d() into its deadloop waiting for the flag, exhausting CPU or hanging I/O
4. Maintain the condition to sustain denial of service

How to detect it

Inspect system logs for repeated raid5d activity, high CPU attribution to the RAID daemon, or LVM-related hangs during recovery; correlate with kernel traces showing blocked md_check_recovery calls.

What your security team should do

• Prioritize kernel upgrades on all systems using md RAID5 to the specified fixed versions
• Monitor for high CPU usage by raid5d and schedule patching during maintenance windows
• Review RAID configurations for unnecessary exposure to local reconfiguration operations