From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 91C3251123A for ; Thu, 17 Sep 2026 16:23:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662219; cv=none; b=F5iwpZ2+wW7IAy6JRy9sqFLXuCKDd/U+t3YTCiCckzJ/rU5IPndjg3pq9JAQrYM7IbeYzIOAR+3YpL+JZegYNBo7z0e6gnjrF4rBKAgwhCNms+WFDZkZk64R/o4P2Xw5KQa4xvKY89Utgk/3oGtPJq6AAggv0uJ7xNKN3ePKGYU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662219; c=relaxed/simple; bh=LEiOYLCP7q85R94BFP3fNAZZhKXxt5AjoYM92Csej/Q=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Eh7zU1ooA2w2XTuzfYoGgrFunxntFBc9aFPjzQ1GAd2ZyeCqbwksEdV2pwnN81HO90BSbgiaDCa7ExLCDxND1+96vqoaL5gyb9nTjUHniMhD85YbrNFSgSD3/8r+r+6WJobDfnJEM6PYbkhkYqeuzo1dUyI9D8Jz/MUDegKqA70= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IrDQcRsB; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="IrDQcRsB" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E699B1F000FF; Thu, 17 Sep 2026 16:23:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789662217; bh=WZF3BgGe/M0iA88v0ikR6iBJ5f37dsONhsW6WslNvfs=; h=From:To:Cc:Subject:Date:Reply-To; b=IrDQcRsBAxRsc+ATJV9iVq5REhEnnu5mGxpdLQIYez5+gyIJQb8BqV1nQ9DXEzczg BNUiw50vHrAhXdm8jaHi9ir8K5YCrGvwb+Qi0nmR5Gr9hZ22MeLW9JYF1ByMzwMpzV MUCwwZWT6QIQttUb3IB6cjOOYcg8IR5gQwz1zGsY= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-90279: md/raid5: round bitmap stripes with sector division Date: Thu, 17 Sep 2026 17:11:49 +0100 Message-ID: <2026091750-CVE-2026-90279-85bb@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3344; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=FRzouMaR3LKj4scehLeMmpzcnvMFFDpcNODW/RjrBo0=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlrBCaF8ea2sE10CWFM710anqRUf3p7O5vs+12bfCokm uz3qC/qiGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgIncWcywYOWq9Kg7CfduNibd mr+pxOU7z69PkQwLJgvnf7IR/VdxdA5j+L2qKcdenDQVAAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5_bitmap_sector_map() aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunk_sectors multiplied by the number of data disks, and it is not always a power of two. Reproduce with a 4-disk RAID5, 1024-sector chunks, and three data disks. The full-stripe width is 3072 sectors. For a one-sector write at array sector 3072, correct rounding gives array range [3072, 6144), which maps to component range [1024, 2048). The old round_down()/round_up() logic instead gives [1024, 4096), which maps to [0, 1024). Use sector_div() based arithmetic so the rounded range is aligned to the actual RAID5 stripe width. The deterministic mapper test now reports the fixed component range as [1024, 2048), while the old mask-based range was [0, 1024). The Linux kernel CVE team has assigned CVE-2026-90279 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6.79 with commit b29e6400be51c214a0ad30dce937348b57abe33a and fixed in 6.6.157 with commit 9d7490007707f90691911385365bd1d691d99225 Issue introduced in 6.12.13 with commit aa8e15d69f5c0044d5bff61844e163aacc4ac172 and fixed in 6.12.110 with commit cab7d949b18b2f1cd625689dc16c5f81236bac93 Issue introduced in 6.14 with commit 9c89f604476cf15c31fbbdb043cff7fbf1dbe0cb and fixed in 6.18.52 with commit 02c10581866d08822c6348e299881485fc546185 Issue introduced in 6.14 with commit 9c89f604476cf15c31fbbdb043cff7fbf1dbe0cb and fixed in 7.2.6 with commit ccbdc483eb041eef809e9ff223d1ad63518a2c52 Issue introduced in 6.14 with commit 9c89f604476cf15c31fbbdb043cff7fbf1dbe0cb and fixed in 7.3-rc1 with commit 17ea021ae74987d6064c8195c4922fa025753892 Issue introduced in 6.13.2 with commit a41a0df5d7638acf15e723ad985980b4f7ff9383 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-90279 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/md/raid5.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9d7490007707f90691911385365bd1d691d99225 https://git.kernel.org/stable/c/cab7d949b18b2f1cd625689dc16c5f81236bac93 https://git.kernel.org/stable/c/02c10581866d08822c6348e299881485fc546185 https://git.kernel.org/stable/c/ccbdc483eb041eef809e9ff223d1ad63518a2c52 https://git.kernel.org/stable/c/17ea021ae74987d6064c8195c4922fa025753892