CVE-2026-90389

What it actually does

Race condition in md subsystem allows one task to enter PF_MEMALLOC_NOIO via sysfs suspend writes while another task restores the saved token from mddev->noio_flags, violating memalloc scope and enabling memory allocations under incorrect noio constraints after array suspension.

Why it matters to the business

May cause kernel memory allocation failures or deadlocks during RAID array suspend/resume operations under concurrent sysfs access, leading to degraded storage availability and potential system instability on affected Linux kernels.

How an attack unfolds

An attacker with local access triggers repeated concurrent writes to suspend_lo and suspend_hi sysfs files from multiple workers, causing one task to retain PF_MEMALLOC_NOIO state after returning to userspace and another to incorrectly restore the token, potentially leading to misbehaving allocations in MD paths.

How to fix it

Update to a Linux kernel version containing the fix that scopes memalloc_noio_save/restore strictly inside allocation-critical sections of mddev_suspend and mddev_resume rather than storing tokens in mddev. Rebuild and reboot with the patched kernel; no configuration changes required.

How to confirm the fix worked

Confirm the patch is present by inspecting the md.c source for memalloc_noio calls limited to allocation sites after suspension, then exercise concurrent suspend sysfs writes while checking that /proc/self/stat flags return to normal before resume completes.

Typical attack path

1. Obtain local unprivileged access on Linux system using md RAID arrays
2. Spawn multiple concurrent workers writing to /sys/block/md*/md/suspend_lo and suspend_hi
3. Monitor /proc/self/stat flags to observe PF_MEMALLOC_NOIO leakage across tasks
4. Trigger subsequent MD allocation paths after array suspension to exploit incorrect noio scope

How to detect it

Review kernel logs for warnings or oopses during md suspend operations, audit sysfs write patterns to md suspend attributes from multiple processes, and inspect process memory flags in /proc for unexpected PF_MEMALLOC_NOIO persistence after sysfs writes.

What your security team should do

• Prioritize kernel updates on systems exposing md sysfs interfaces to untrusted local users
• Monitor EPSS and upstream stable branches for backports given 37 days since publication
• Restrict unprivileged access to md sysfs attributes via mount options or SELinux policies until patched
• Test patched kernels in staging environments with concurrent suspend workloads before production rollout