Cloudanix VulnDB

CVE-2026-90401

High · 7.1

CVSS

7.1

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A storage driver bug could let certain disk operations leave mirrored copies of data out of sync, risking silent corruption on systems that use software RAID.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incomplete REQ_NOWAIT handling in md raid1/raid10/raid456 allows write requests to succeed on one mirror while returning -EAGAIN on another, preventing bad-block recording or safe retry and leaving divergent mirror data.

Why it matters to the business

Storage arrays can silently develop inconsistent replicas, increasing risk of data loss, failed recovery, and operational downtime when using RAID1/10/456 configurations under queue-pressure or error conditions.

How an attack unfolds

A local attacker issues concurrent writes that trigger internal blocking paths in the affected RAID personalities; when one leg returns -EAGAIN the personality cannot safely reconcile the outcome, resulting in permanent mirror divergence without administrator-visible failure.

How to fix it

Update the Linux kernel to a version that removes REQ_NOWAIT support from raid1, raid10 and raid456 (the resolution described in the patch); linear and raid0 personalities retain the feature.

How to confirm the fix worked

Confirm the running kernel contains the commit that drops REQ_NOWAIT from the affected personalities; re-test RAID write behavior under simulated queue pressure to verify -EAGAIN no longer produces divergent mirrors.

Typical attack path

  1. Obtain local unprivileged access on a system using md raid1, raid10 or raid456
  2. Generate write I/O patterns that exercise internal blocking paths while one or more component devices return queue pressure
  3. Observe or trigger mirror divergence that cannot be reconciled because REQ_NOWAIT was not properly supported

How to detect it

Review kernel logs for md/raid error paths involving -EAGAIN on writes; inspect sysfs raid personality flags for unexpected REQ_NOWAIT advertisement; correlate with application-level I/O errors that indicate mirror inconsistency.

What your security team should do

  • Prioritize kernel upgrades on all systems using md RAID1/10/456 within the next maintenance window
  • Audit storage configurations for reliance on REQ_NOWAIT and disable it where possible until patched
  • Monitor EPSS and exploit-maturity indicators for any future rise in weaponization

The record

In the Linux kernel, the following vulnerability has been resolved: md: remove REQ_NOWAIT support from raid1/10/456 REQ_NOWAIT support in md personalities that can block internally is fundamentally incomplete. While reads can avoid some blocking paths, write requests can still encounter cases where one mirror succeeds while another returns -EAGAIN. At that point md cannot distinguish queue pressure from a real device failure, so it can neither record a bad block nor safely retry the write without REQ_NOWAIT, leaving mirrors with divergent data. Rather than continue advertising REQ_NOWAIT support for personalities that cannot implement it correctly, remove it from raid1, raid10 and raid456. Keep REQ_NOWAIT for linear and raid0, which only remap bios to their underlying devices; stacked limits will still clear the feature if any component device lacks REQ_NOWAIT support.

Affected packages

Ecosystem Package Introduced Fixed