CVE-2026-43271

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

md-cluster: fix NULL pointer dereference in process_metadata_update

The function process_metadata_update() blindly dereferences the 'thread'

pointer (acquired via rcu_dereference_protected) within the wait_event()

macro.

While the code comment states "daemon thread must exist", there is a valid

race condition window during the MD array startup sequence (md_run):

1. bitmap_load() is called, which invokes md_cluster_ops->join().

2. join() starts the "cluster_recv" thread (recv_daemon).

3. At this point, recv_daemon is active and processing messages.

4. However, mddev->thread (the main MD thread) is not initialized until

later in md_run().

If a METADATA_UPDATED message is received from a remote node during this

specific window, process_metadata_update() will be called while

mddev->thread is still NULL, leading to a kernel panic.

To fix this, we must validate the 'thread' pointer. If it is NULL, we

release the hel

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References