Look up another CVE · open CVE-2026-89558 in the interactive tracker
CVE-2026-89558
md/raid10: fix still_degraded being inverted in raid10_sync_request()
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem drivers/md. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-89558 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Commit fe6a19d40ceb ("md/md-bitmap: merge md_bitmap_start_sync() into bitmap_operations") converted still_degraded from int to bool, but inverted the assignment in the loop that checks whether the array will still be degraded after the current device is recovered: "still_degraded = 1" became "still_degraded = false". As a result, recovering a device while another mirror is still missing calls md_bitmap_start_sync() with degraded == false, which clears bitmap bits that the still-missing device needs. When that device is re-added, its bitmap-based recovery finds the bits already cleared and skips every region written while the array was degraded, so it is marked In_sync while holding stale data: silent corruption. Reproducer (raid10 near=2, 4 disks, internal bitmap): - fail and remove one disk of each mirror pair - write to the degraded array - re-add both disks and let recovery finish - "check" reports mismatch_cnt=262272 after 256 MiB of degraded writes and file contents differ; the second disk's "recovery" completes in milliseconds because everything is skipped The same conversion in raid1 got it right (still_degraded = true). Restore the correct value.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/md/raid10.c
- What this is
- SOFTWARE RAID (Multiple Disks) SUPPORTMAINTAINERS section matched on drivers/md/raid* · linux-raid@vger.kernel.org · Supported
- Kernel module
- raid10
Check it on the machine
grep -wE 'CONFIG_MD|CONFIG_MD_RAID10' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w raid10Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_MD, CONFIG_MD_RAID10
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.64%, higher than 49.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/md
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.12 | 6.12.109 | 9bb8da6ecb33 |
| 6.12 | 6.18.50 | 0efabe6229dc |
| 6.12 | 7.2.4 | 00449d752bee |
| 6.12 | 7.3 | 47f1441b281d |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- md RAID10 commonly backs NAS/SAN volumes exported over NFS, ksmbd, iSCSI, and NVMe-oF. Remote writes during dual-degraded operation dirty the write-intent bitmap, and after buggy recovery remote reads reach md_submit_bio()->raid10_read_request()->read_balance() and are served from the stale In_sync mirror without local shell access.
- AC:LAttack complexity, low
- The inverted still_degraded assignment is deterministic in raid10_sync_request() whenever one member is recovered while another remains missing or Faulty. The documented fail/remove/write/re-add sequence needs no race or attacker-uncontrolled memory layout; write-intent bitmaps on RAID10 are a standard mdadm default, not a rare config.
- PR:NPrivileges required, none
- Client I/O to an exported RAID10 LUN needs no Linux UID or host capability: unauthenticated iSCSI/NVMe-oF and guest NFS/SMB writes reach md_submit_bio() and later read stale mirrors. md ioctls/sysfs fail/re-add use capable(CAP_SYS_ADMIN), but hot-spare recovery and storage-protocol I/O do not, so Privileges Required is None rather than High.
- UI:NUser interaction, none
- No victim click, mount, or confirmation is required. The attacker or automated storage clients issue ordinary reads and writes; md_check_recovery() and md_start_sync() invoke raid10_sync_request() from hot-spare activation or disk re-add as kernel background work.
- S:UScope, unchanged
- Silent corruption, stale-data disclosure, and volume unavailability remain inside the host kernel and the md RAID10 array. The bug does not escape a VM, bypass an IOMMU, or otherwise cross a separate security authority.
- C:HConfidentiality impact, high
- raid10_spare_active() sets In_sync on the re-added member while it still holds stale sectors. read_balance() then returns that disk's prior contents, including previously freed blocks that the current filesystem layout may assign to other users' or overwritten files, disclosing unauthorized data.
- I:HIntegrity impact, high
- md_bitmap_start_sync() is called with degraded=false, clearing NEEDED bits the still-missing mirror requires. That device is marked In_sync after skipping dirty regions; later read-modify-write of the stale data is mirrored to all copies, permanently corrupting filesystem and user data.
- A:HAvailability impact, high
- Stale filesystem metadata served from the wrongly In_sync mirror drives remount-ro, XFS shutdown, or panic on errors=panic, and skipped bitmap recovery leaves dirty regions unrestored, denying availability of the RAID10 volume and any boot or data filesystems on it.