CVE-2024-43914

What it actually does

Improper validation of reshape position and raid_disks metadata after --revert-reshape allows a writepos check to fail, triggering BUG_ON() in reshape_request and causing kernel panic during md/raid5 array reassembly and reshape continuation.

Why it matters to the business

Unexpected kernel crashes on Linux systems using software RAID5/6 can interrupt storage services, cause unplanned downtime, and require manual intervention to recover arrays, especially in environments performing reshape or grow operations.

How an attack unfolds

An attacker with local access or control over mdadm invokes --revert-reshape to alter raid_disks while leaving reshape position in the superblock; on reassembly the kernel reads the stale position, the writepos check fails during reshape, and the resulting BUG_ON() panics the system. Listed threat actors may leverage similar Linux kernel stability issues for denial of service in espionage or financially motivated campaigns.

How to fix it

Upgrade affected Linux kernels to commit 2c92f8c1c456d556f15cbf51667b385026b2e6a0 or later releases that replace the BUG_ON() with WARN_ON() and stop the reshape on failure; also apply corresponding mdadm fixes for --revert-reshape handling. For Android platforms, ensure devices are on versions fixed since 2022-11-01 (10/11/12/12L/13).

How to confirm the fix worked

Confirm kernel builds contain the referenced commit, verify that reshape operations with --revert-reshape complete without BUG_ON() or invalid opcode panics, and inspect superblock consistency after reassembly.

Typical attack path

1. Obtain local or privileged access to a system managing an md/raid5 array
2. Use mdadm --revert-reshape to abort a reshape and update raid_disks metadata
3. Reassemble the array so the kernel reads the inconsistent superblock
4. Trigger or allow the reshape operation to begin
5. Force the failing writepos check to hit BUG_ON() and panic the kernel

How to detect it

Search kernel logs, dmesg, and syslog for "kernel BUG at drivers/md/raid5.c:6278", "invalid opcode", "md0_reshape" process crashes, and raid5_sync_request call traces; correlate with mdadm reshape or reassembly events.

• kernel BUG at drivers/md/raid5.c:6278
• invalid opcode: 0000 [#1] PREEMPT SMP PTI
• RIP: 0010:reshape_request+0x3f1/0xe60
• md0_reshape
• raid5_sync_request+0x43d/0x550

What your security team should do

• Apply the fixed kernel commit or distribution update immediately on all systems exposing md/raid5 arrays
• Disable or restrict use of --revert-reshape until mdadm is also patched
• Monitor kernel logs for raid5.c BUG_ON() and md0_reshape crashes
• Test array reshape workflows in staging before production rollout
• Review downstream dependents and schedule kernel upgrades across fleets