CVE-2026-90275

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: don't set array_frozen in raid1_takeover()

raid1_takeover() sets conf->array_frozen = 1 on the newly-allocated

r1conf and nothing ever clears it, so every I/O to the array stalls

permanently once _wait_barrier() sees it stuck at 1.

This used to be harmless: level_store() called mddev_resume() right

after pers->run(), which called raid1_quiesce(mddev, 0) and cleared

array_frozen back to 0 regardless of what raid1_takeover() set. Commit

b39f35ebe86d ("md: don't quiesce in mddev_suspend()") removed that

quiesce(mddev, 0) call, so the pre-set now sticks.

setup_conf() already zero-initializes the new r1conf via kzalloc, so

just don't set array_frozen here.

Same class of bug as commit 892da88d1cd9 ("md/raid10: fix a

'conf->barrier' leakage in raid10_takeover()"), also triggered by

b39f35ebe86d.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References