CVE-2026-45888

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

May 27, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in the Linux kernel can slowly use up memory on computers that store data across multiple disks in a mirrored setup, eventually slowing them down or causing crashes.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: Low
Impact: Denial Of Service
Component: OS kernel
Class: Memory Corruption
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Memory leak of md_thread structure and associated thread resources in raid1_run() when raid1_set_limits() fails after md_register_thread() succeeds, because the error path omits the corresponding unregister call.

Why it matters to the business

Systems configured with Linux software RAID1 may experience gradual memory exhaustion after repeated initialization failures, potentially degrading performance or causing denial of service on long-running servers.

How an attack unfolds

An attacker with local access triggers repeated raid1 array creation attempts that reach the setup_conf() registration but then fail at raid1_set_limits(), causing the kernel to leak thread objects on each failure without any remote code execution or privilege escalation path.

How to fix it

Apply the upstream kernel patch that inserts md_unregister_thread() in the raid1_set_limits() failure path of raid1_run(); rebuild and deploy the corrected kernel image on all affected systems.

How to confirm the fix worked

Inspect the raid1.c source for the presence of md_unregister_thread() immediately after the raid1_set_limits() error label; confirm the fixed kernel boots and initializes RAID1 arrays without leaking thread objects under the same failure conditions.

Typical attack path

Obtain local access to a system using md/raid1
Repeatedly attempt to create or assemble a RAID1 array under conditions that cause raid1_set_limits() to fail after thread registration
Accumulate leaked md_thread structures until memory pressure leads to operational impact

How to detect it

Review kernel memory accounting and slab allocator statistics for persistent growth of md_thread objects; correlate with system logs showing repeated raid1 initialization failures.

What your security team should do

Patch all Linux kernels to a version containing the raid1_run() error-path fix
Monitor kernel memory usage on systems hosting md/raid1 arrays for unexplained growth
Restrict local user privileges that could repeatedly trigger array assembly failures

The record

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix memory leak in raid1_run() raid1_run() calls setup_conf() which registers a thread via md_register_thread(). If raid1_set_limits() fails, the previously registered thread is not unregistered, resulting in a memory leak of the md_thread structure and the thread resource itself. Add md_unregister_thread() to the error path to properly cleanup the thread, which aligns with the error handling logic of other paths in this function. Compile tested only. Issue found using a prototype static analysis tool and code review.

Affected packages

Ecosystem	Package	Introduced	Fixed