Cloudanix VulnDB

CVE-2026-90279

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A calculation error in Linux RAID disk handling could cause the system to track writes incorrectly on certain disk setups, potentially leading to data problems that the latest kernel update corrects.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect use of round_down/round_up in raid5_bitmap_sector_map() fails to align ranges to actual RAID5 stripe width (chunk_sectors * data disks) when that width is not a power of two, producing wrong component-sector ranges for bitmap updates.

Why it matters to the business

On affected RAID5 arrays, write operations may update the wrong bitmap regions, risking data inconsistency, failed rebuilds, or silent corruption after crashes or power loss.

How an attack unfolds

An attacker with local write access to a vulnerable 4-disk RAID5 array (1024-sector chunks) issues a one-sector write at a stripe-boundary sector such as 3072; the faulty rounding maps it to an incorrect component range, corrupting bitmap state that later affects recovery or parity calculations.

How to fix it

Upgrade the Linux kernel to a version containing the sector_div()-based arithmetic fix in raid5_bitmap_sector_map(); rebuild and test RAID arrays with non-power-of-two stripe widths.

How to confirm the fix worked

Run the deterministic mapper test and confirm it now reports the corrected component range [1024, 2048) for the 3072-sector write case instead of the prior erroneous [0, 1024).

Typical attack path

  1. Locate system using md/raid5 with stripe width not a power of two
  2. Issue targeted write at array sector aligned to full stripe but not power-of-two multiple
  3. Trigger bitmap update via the flawed sector mapping
  4. Observe subsequent RAID recovery or resync failures

How to detect it

Review kernel logs for md/raid5 bitmap sector mapping anomalies, unexpected resync ranges, or parity-check failures on arrays with 3072-sector stripe widths; examine dmesg and RAID event logs around write timestamps.

What your security team should do

  • Prioritize kernel updates on all systems hosting RAID5 arrays
  • Audit RAID configurations for chunk sizes producing non-power-of-two stripe widths
  • Enable RAID bitmap consistency checks and monitor resync logs after patching

The record

In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5_bitmap_sector_map() aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunk_sectors multiplied by the number of data disks, and it is not always a power of two. Reproduce with a 4-disk RAID5, 1024-sector chunks, and three data disks. The full-stripe width is 3072 sectors. For a one-sector write at array sector 3072, correct rounding gives array range [3072, 6144), which maps to component range [1024, 2048). The old round_down()/round_up() logic instead gives [1024, 4096), which maps to [0, 1024). Use sector_div() based arithmetic so the rounded range is aligned to the actual RAID5 stripe width. The deterministic mapper test now reports the fixed component range as [1024, 2048), while the old mask-based range was [0, 1024).

Affected packages

Ecosystem Package Introduced Fixed