From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B34ED2773CA for ; Fri, 8 May 2026 13:14:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778246084; cv=none; b=BEEuhhoPX3jNDSaU7d09FN61bBJdPHrYbIMDlj91UWuIlmV4lK48FT3wnQp32pF9K0iNVFnAZGUfdzkVq3NEjzpf3yu4+ulMmg7WC6lz+zWVCfyJuQXBG7otZ+hZzNCPM6vaqH9J/Usx0WRvO+AjcAh6DWhLY3e+Qw0i/gUR1ks= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778246084; c=relaxed/simple; bh=8HcYjmoQLraHXcMMpvMJI1g9AfhnHsYYTxsLdDYt5es=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gf8YONQz9uIl66er86D9xu1sD+Ga6Q9GCz7uj0BsM/ZxV4tSkk0qr/cLtJFEY0cp+LGeEhq0SPQC3AM5vqKoKnnXjGxAMTN3zV3pdWyjDUgUq09Il1SJDE094KfBH+6w7FvO1xFkb2TSc/UmrjljLiE5FLt+O0LDEgh3y6rxrPI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=abnQoRoE; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="abnQoRoE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0C31BC2BCB0; Fri, 8 May 2026 13:14:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778246084; bh=8HcYjmoQLraHXcMMpvMJI1g9AfhnHsYYTxsLdDYt5es=; h=From:To:Cc:Subject:Date:Reply-To:From; b=abnQoRoEUDNeIJVB5CRfLZJpfknBy74l6SHkG865VFX6CINlgTIjpKtZ8aqOzyxGV kZ0Yiq3OBwxbBU48oMzVvIdoswV2SpzmTXUqfRtxMHJZGY8UCCLr7HNKVzb5p+sOeh omXlwVNavJv+kwfj/YqonYi7eXpP2Gi87zDMMG/Q= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid Date: Fri, 8 May 2026 15:12:14 +0200 Message-ID: <2026050859-CVE-2026-43309-873c@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2953; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=UvAglMfu1kCqmoLo1tcSZrLFdLqmD5Ecv4aw3VOHf+I=; b=owGbwMvMwCRo6H6F97bub03G02pJDJl/H8rn3Ztxzbg8+VCX7hOtBeKP/hVN439y7TEL88c3W /scDV5964hlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJcExjWDC/7nhRlhh3REHP MzfZFd8cRfckGzMs2PxcuCTHtnH7uWtacnPLNe/9tZ27GgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions. This occurs when: - A dm-raid managed device tree is suspended from top to bottom (the top-level RAID device is suspended first, followed by its underlying metadata and data devices) - The top-level RAID device is then removed Removing the top-level device triggers a hang in the following sequence: the dm-raid destructor calls md_stop(), which tries to flush the write-intent bitmap by writing to the metadata sub-devices. However, these devices are already suspended, making them unable to complete the write-intent operations and causing an indefinite block. Fix: - Prevent bitmap flushing when md_stop() is called from dm-raid destructor context and avoid a quiescing/unquescing cycle which could also cause I/O - Still allow write-intent bitmap flushing when called from dm-raid suspend context This ensures that RAID array teardown can complete successfully even when the underlying devices are in a suspended state. This second patch uses md_is_rdwr() to distinguish between suspend and destructor paths as elaborated on above. The Linux kernel CVE team has assigned CVE-2026-43309 to this issue. Affected and fixed versions =========================== Fixed in 6.18.16 with commit 24783dd06de870d646c25207bae186f78195f912 Fixed in 6.19.6 with commit 338378dfffbdbb8d37a18f0a0c0358812671f91e Fixed in 7.0 with commit cefcb9297fbdb6d94b61787b4f8d84f55b741470 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-43309 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/md/md.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/24783dd06de870d646c25207bae186f78195f912 https://git.kernel.org/stable/c/338378dfffbdbb8d37a18f0a0c0358812671f91e https://git.kernel.org/stable/c/cefcb9297fbdb6d94b61787b4f8d84f55b741470