CVE-2026-43309

md raid: fix hang when stopping arrays with metadata through dm-raid

MEDIUM
5.5
CVSS Score
Published: May 8, 2026 at 01:11 PM UTC
Updated: October 21, 2026 at 01:18 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions. This occurs when: - A dm-raid managed device tree is suspended from top to bottom (the top-level RAID device is suspended first, followed by its underlying metadata and data devices) - The top-level RAID device is then removed Removing the top-level device triggers a hang in the following sequence: the dm-raid destructor calls md_stop(), which tries to flush the write-intent bitmap by writing to the metadata sub-devices. However, these devices are already suspended, making them unable to complete the write-intent operations and causing an indefinite block. Fix: - Prevent bitmap flushing when md_stop() is called from dm-raid destructor context and avoid a quiescing/unquescing cycle which could also cause I/O - Still allow write-intent bitmap flushing when called from dm-raid suspend context This ensures that RAID array teardown can complete successfully even when the underlying devices are in a suspended state. This second patch uses md_is_rdwr() to distinguish between suspend and destructor paths as elaborated on above.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.14.292 ≤ v < 4.154.19.257 ≤ v < 4.205.10.140 ≤ v < 5.115.15.64 ≤ v < 5.165.19.6 ≤ v < 6.05.4.212 ≤ v < 5.56.0.1 ≤ v < 6.18.166.19 ≤ v < 6.19.60dd84b319352bb8ba64752d4e45396d8b13e60181678ca35b80a94d474fdc31e2497ce5d7ed525124.14.2924.19.2575.10.1405.15.645.19.65.4.2126.06.0 rc36.0 rc46.0 rc56.0 rc66.0 rc7661c01b2181d9413c799127f13143583b69f20fd690b5c90fd2d81fd1d2b6110fa36783232f6dce28e7fb19f1a744fd34e982633ced756fee0498ef7a5a58fab556bfe618b4c9719eb85712d78c6cb10f42a9819ba84bed2e609a4dff56af37063dcabdc
Vendor states this is fixed in 24783dd06de870d646c25207bae186f78195f912 (fixed)
Vendor states this is fixed in 338378dfffbdbb8d37a18f0a0c0358812671f91e (fixed)
Vendor states this is fixed in cefcb9297fbdb6d94b61787b4f8d84f55b741470 (fixed)
Affected range stops below 4.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.20, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.11, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.16, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.20, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.0 (unaffected)
Vendor states this is fixed in 6.12.114 (unaffected)
Vendor states this is fixed in 6.18.16 (unaffected)
Vendor states this is fixed in 6.19.6 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card