CVE-2026-46051

md/raid5: fix soft lockup in retry_aligned_read()

MEDIUM
5.5
CVSS Score
Published: May 27, 2026 at 12:57 PM UTC
Updated: October 15, 2026 at 02:19 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix soft lockup in retry_aligned_read() When retry_aligned_read() encounters an overlapped stripe, it releases the stripe via raid5_release_stripe() which puts it on the lockless released_stripes llist. In the next raid5d loop iteration, release_stripe_list() drains the stripe onto handle_list (since STRIPE_HANDLE is set by the original IO), but retry_aligned_read() runs before handle_active_stripes() and removes the stripe from handle_list via find_get_stripe() -> list_del_init(). This prevents handle_stripe() from ever processing the stripe to resolve the overlap, causing an infinite loop and soft lockup. Fix this by using __release_stripe() with temp_inactive_list instead of raid5_release_stripe() in the failure path, so the stripe does not go through the released_stripes llist. This allows raid5d to break out of its loop, and the overlap will be resolved when the stripe is eventually processed by handle_stripe().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.12 ≤ v < 5.10.2585.11 ≤ v < 5.15.2095.16 ≤ v < 6.1.1756.13 ≤ v < 6.18.276.19 ≤ v < 7.0.46.2 ≤ v < 6.6.1406.7 ≤ v < 6.12.863.12773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6
Vendor states this is fixed in 09880592f5a9dc73377d6eb5ac123537b5f8df49 (fixed)
Vendor states this is fixed in 1985cb3247e87ff6b8ca4bc5f9626f4f51024507 (fixed)
Vendor states this is fixed in 4166d5234fe8b6c3c7f796a6c198605356c5b355 (fixed)
Vendor states this is fixed in 66df9f30673db66ac35145820a8e24906069ae57 (fixed)
Vendor states this is fixed in 7f9f7c697474268d9ef9479df3ddfe7cdcfbbffc (fixed)
Vendor states this is fixed in 80fc6ca2cbde018d52e13f305edcd643911bd94b (fixed)
Vendor states this is fixed in 883cc33b7af1c448663287f069ef9dfea001e90f (fixed)
Vendor states this is fixed in a9055300e07d9d6800264d3c2560e1d0144689ca (fixed)
Vendor states this is fixed in 3.12 (unaffected)
Vendor states this is fixed in 5.10.258 (unaffected)
Vendor states this is fixed in 5.15.209 (unaffected)
Vendor states this is fixed in 6.1.175 (unaffected)
Vendor states this is fixed in 6.12.86 (unaffected)
Vendor states this is fixed in 6.18.27 (unaffected)
Vendor states this is fixed in 6.6.140 (unaffected)
Vendor states this is fixed in 7.0.4 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-667

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card