{"api_version":"1","generated_at":"2026-10-27T05:58:11+00:00","cve":"CVE-2026-90401","urls":{"html":"https://cve.report/CVE-2026-90401","api":"https://cve.report/api/cve/CVE-2026-90401.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90401","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90401"},"summary":{"title":"md: remove REQ_NOWAIT support from raid1/10/456","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: remove REQ_NOWAIT support from raid1/10/456\n\nREQ_NOWAIT support in md personalities that can block internally is\nfundamentally incomplete. While reads can avoid some blocking paths,\nwrite requests can still encounter cases where one mirror succeeds while\nanother returns -EAGAIN. At that point md cannot distinguish queue\npressure from a real device failure, so it can neither record a bad\nblock nor safely retry the write without REQ_NOWAIT, leaving mirrors\nwith divergent data.\n\nRather than continue advertising REQ_NOWAIT support for personalities\nthat cannot implement it correctly, remove it from raid1, raid10 and\nraid456. Keep REQ_NOWAIT for linear and raid0, which only remap bios to\ntheir underlying devices; stacked limits will still clear the feature if\nany component device lacks REQ_NOWAIT support.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-17 17:17:39","updated_at":"2026-10-19 09:19:34"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","data":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/9bb9504e2d8f3d22ef12d51c333dd499f402dc8f","name":"https://git.kernel.org/stable/c/9bb9504e2d8f3d22ef12d51c333dd499f402dc8f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ffcc9ea4e4d121c78aef6654a1577aa7d120774d","name":"https://git.kernel.org/stable/c/ffcc9ea4e4d121c78aef6654a1577aa7d120774d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","name":"https://git.kernel.org/stable/c/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90401","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90401","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f51d46d0e7cb5b8494aa534d276a9d8915a2443d ffcc9ea4e4d121c78aef6654a1577aa7d120774d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f51d46d0e7cb5b8494aa534d276a9d8915a2443d 9bb9504e2d8f3d22ef12d51c333dd499f402dc8f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f51d46d0e7cb5b8494aa534d276a9d8915a2443d 3fe5b7c9fb72ccc29bfd0f955b124892af7e3674 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 39db562b3fedb93978a7e42dd216b306740959f8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.111 5.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.17","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.57 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.6 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"90401","cve":"CVE-2026-90401","epss":"0.001100000","percentile":"0.014680000","score_date":"2026-09-21","updated_at":"2026-09-22 00:03:18"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/md/md-bitmap.c","drivers/md/md-bitmap.h","drivers/md/md-linear.c","drivers/md/md-llbitmap.c","drivers/md/md.c","drivers/md/raid0.c","drivers/md/raid1-10.c","drivers/md/raid1.c","drivers/md/raid10.c","drivers/md/raid5.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ffcc9ea4e4d121c78aef6654a1577aa7d120774d","status":"affected","version":"f51d46d0e7cb5b8494aa534d276a9d8915a2443d","versionType":"git"},{"lessThan":"9bb9504e2d8f3d22ef12d51c333dd499f402dc8f","status":"affected","version":"f51d46d0e7cb5b8494aa534d276a9d8915a2443d","versionType":"git"},{"lessThan":"3fe5b7c9fb72ccc29bfd0f955b124892af7e3674","status":"affected","version":"f51d46d0e7cb5b8494aa534d276a9d8915a2443d","versionType":"git"},{"status":"affected","version":"39db562b3fedb93978a7e42dd216b306740959f8","versionType":"git"},{"lessThan":"5.16","status":"affected","version":"5.15.111","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/md/md-bitmap.c","drivers/md/md-bitmap.h","drivers/md/md-linear.c","drivers/md/md-llbitmap.c","drivers/md/md.c","drivers/md/raid0.c","drivers/md/raid1-10.c","drivers/md/raid1.c","drivers/md/raid10.c","drivers/md/raid5.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.57","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.6","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.111","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: remove REQ_NOWAIT support from raid1/10/456\n\nREQ_NOWAIT support in md personalities that can block internally is\nfundamentally incomplete. While reads can avoid some blocking paths,\nwrite requests can still encounter cases where one mirror succeeds while\nanother returns -EAGAIN. At that point md cannot distinguish queue\npressure from a real device failure, so it can neither record a bad\nblock nor safely retry the write without REQ_NOWAIT, leaving mirrors\nwith divergent data.\n\nRather than continue advertising REQ_NOWAIT support for personalities\nthat cannot implement it correctly, remove it from raid1, raid10 and\nraid456. Keep REQ_NOWAIT for linear and raid0, which only remap bios to\ntheir underlying devices; stacked limits will still clear the feature if\nany component device lacks REQ_NOWAIT support."}],"metrics":[{"cvssV3_1":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The REQ_NOWAIT bit that drives the bug is set in blkdev_direct_IO() from IOCB_NOWAIT (pwritev2 RWF_NOWAIT or io_uring io_write() with O_DIRECT) on the md gendisk, then md_submit_bio()->raid1_write_request()/raid10_write_request(). nfsd, ksmbd, nvmet_bdev_execute_rw(), and iSCSI iblock submit ordinary READ/WRITE bios without REQ_NOWAIT, so no protocol message carries the flag.\nAC:L - md_init_stacking_limits() advertised BLK_FEAT_NOWAIT, so member clones kept REQ_NOWAIT and raid1_should_handle_error() ignored their failures. The attacker issues concurrent O_DIRECT nowait writes via io_uring/pwritev2 to fill one member's request queue until it returns BLK_STS_AGAIN while the other mirror completes; no uninfluenced race is required.\nPR:L - blkdev_direct_IO() performs no capable() check. Any process that can open the md node or a stacked dm LV (disk group, container CSI block volume, or a delegated /dev/mdX) can issue RWF_NOWAIT O_DIRECT I/O; init-namespace root is not required.\nUI:N - The attacker opens the md block device themselves and issues pwritev2(RWF_NOWAIT) or io_uring io_write(); no separate victim must mount a filesystem, attach media, or confirm an action.\nS:U - Divergent raid1/raid10 mirrors and skipped WriteErrorSeen/bad-block recording remain inside the host md array. The bug does not escape a VM, bypass an IOMMU, or cross another security authority.\nC:N - raid1_end_write_request() ignore_error only skips WriteErrorSeen and R1BIO_WriteError; it does not read other tenants' data or kernel memory. A failed nowait read forced uptodate in raid1_end_read_request() completes into the attacker's own O_DIRECT buffers.\nI:H - When one raid1/raid10 clone succeeds and another returns BLK_STS_AGAIN, raid1_should_handle_error() sets ignore_error, raid1_end_write_request() still sets R1BIO_Uptodate, and raid_end_bio_io() reports success while mirrors hold different data and real member failures are not recorded as bad blocks.\nA:H - raid5 make_discard_request() returned without bio_endio() on REQ_NOWAIT, hanging the discard bio. Ignored member failures also leave a disk In_sync after a nowait EAGAIN, so a later loss of the up-to-date mirror makes diverged sectors unrecoverable and can take the array/filesystem offline."}]}],"providerMetadata":{"dateUpdated":"2026-10-19T09:03:05.286Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/ffcc9ea4e4d121c78aef6654a1577aa7d120774d"},{"url":"https://git.kernel.org/stable/c/9bb9504e2d8f3d22ef12d51c333dd499f402dc8f"},{"url":"https://git.kernel.org/stable/c/3fe5b7c9fb72ccc29bfd0f955b124892af7e3674"}],"title":"md: remove REQ_NOWAIT support from raid1/10/456","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-90401","datePublished":"2026-09-17T16:09:31.556Z","dateReserved":"2026-09-11T19:38:34.811Z","dateUpdated":"2026-10-19T09:03:05.286Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 17:17:39","lastModifiedDate":"2026-10-19 09:19:34","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90401","Ordinal":"1","Title":"md: remove REQ_NOWAIT support from raid1/10/456","CVE":"CVE-2026-90401","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90401","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: remove REQ_NOWAIT support from raid1/10/456\n\nREQ_NOWAIT support in md personalities that can block internally is\nfundamentally incomplete. While reads can avoid some blocking paths,\nwrite requests can still encounter cases where one mirror succeeds while\nanother returns -EAGAIN. At that point md cannot distinguish queue\npressure from a real device failure, so it can neither record a bad\nblock nor safely retry the write without REQ_NOWAIT, leaving mirrors\nwith divergent data.\n\nRather than continue advertising REQ_NOWAIT support for personalities\nthat cannot implement it correctly, remove it from raid1, raid10 and\nraid456. Keep REQ_NOWAIT for linear and raid0, which only remap bios to\ntheir underlying devices; stacked limits will still clear the feature if\nany component device lacks REQ_NOWAIT support.","Type":"Description","Title":"md: remove REQ_NOWAIT support from raid1/10/456"}]}}}