CVE-2026-89558

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89558", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.724Z", "datePublished": "2026-09-11T19:44:30.588Z", "dateUpdated": "2026-10-19T08:48:51.700Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:48:51.700Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix still_degraded being inverted in raid10_sync_request()\n\nCommit fe6a19d40ceb (\"md/md-bitmap: merge md_bitmap_start_sync() into\nbitmap_operations\") converted still_degraded from int to bool, but\ninverted the assignment in the loop that checks whether the array will\nstill be degraded after the current device is recovered:\n\"still_degraded = 1\" became \"still_degraded = false\".\n\nAs a result, recovering a device while another mirror is still missing\ncalls md_bitmap_start_sync() with degraded == false, which clears bitmap\nbits that the still-missing device needs. When that device is re-added,\nits bitmap-based recovery finds the bits already cleared and skips every\nregion written while the array was degraded, so it is marked In_sync\nwhile holding stale data: silent corruption.\n\nReproducer (raid10 near=2, 4 disks, internal bitmap):\n - fail and remove one disk of each mirror pair\n - write to the degraded array\n - re-add both disks and let recovery finish\n - \"check\" reports mismatch_cnt=262272 after 256 MiB of degraded\n writes and file contents differ; the second disk's \"recovery\"\n completes in milliseconds because everything is skipped\n\nThe same conversion in raid1 got it right (still_degraded = true).\nRestore the correct value."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - md RAID10 commonly backs NAS/SAN volumes exported over NFS, ksmbd, iSCSI, and NVMe-oF. Remote writes during dual-degraded operation dirty the write-intent bitmap, and after buggy recovery remote reads reach md_submit_bio()->raid10_read_request()->read_balance() and are served from the stale In_sync mirror without local shell access.\nAC:L - The inverted still_degraded assignment is deterministic in raid10_sync_request() whenever one member is recovered while another remains missing or Faulty. The documented fail/remove/write/re-add sequence needs no race or attacker-uncontrolled memory layout; write-intent bitmaps on RAID10 are a standard mdadm default, not a rare config.\nPR:N - Client I/O to an exported RAID10 LUN needs no Linux UID or host capability: unauthenticated iSCSI/NVMe-oF and guest NFS/SMB writes reach md_submit_bio() and later read stale mirrors. md ioctls/sysfs fail/re-add use capable(CAP_SYS_ADMIN), but hot-spare recovery and storage-protocol I/O do not, so Privileges Required is None rather than High.\nUI:N - No victim click, mount, or confirmation is required. The attacker or automated storage clients issue ordinary reads and writes; md_check_recovery() and md_start_sync() invoke raid10_sync_request() from hot-spare activation or disk re-add as kernel background work.\nS:U - Silent corruption, stale-data disclosure, and volume unavailability remain inside the host kernel and the md RAID10 array. The bug does not escape a VM, bypass an IOMMU, or otherwise cross a separate security authority.\nC:H - raid10_spare_active() sets In_sync on the re-added member while it still holds stale sectors. read_balance() then returns that disk's prior contents, including previously freed blocks that the current filesystem layout may assign to other users' or overwritten files, disclosing unauthorized data.\nI:H - md_bitmap_start_sync() is called with degraded=false, clearing NEEDED bits the still-missing mirror requires. That device is marked In_sync after skipping dirty regions; later read-modify-write of the stale data is mirrored to all copies, permanently corrupting filesystem and user data.\nA:H - Stale filesystem metadata served from the wrongly In_sync mirror drives remount-ro, XFS shutdown, or panic on errors=panic, and skipped bitmap recovery leaves dirty regions unrestored, denying availability of the RAID10 volume and any boot or data filesystems on it."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/raid10.c"], "versions": [{"version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4", "status": "affected", "versionType": "git"}, {"version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "0efabe6229dc683dbf6eeebd0f9fddc7971ed420", "status": "affected", "versionType": "git"}, {"version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "00449d752bee9c8787f42ea1bf533a9fb17f9b6b", "status": "affected", "versionType": "git"}, {"version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "47f1441b281decde6954a2fa82b4131637d685ac", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/raid10.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4"}, {"url": "https://git.kernel.org/stable/c/0efabe6229dc683dbf6eeebd0f9fddc7971ed420"}, {"url": "https://git.kernel.org/stable/c/00449d752bee9c8787f42ea1bf533a9fb17f9b6b"}, {"url": "https://git.kernel.org/stable/c/47f1441b281decde6954a2fa82b4131637d685ac"}], "title": "md/raid10: fix still_degraded being inverted in raid10_sync_request()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/md/raid10.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4", "status": "affected", "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "versionType": "git"}, {"lessThan": "0efabe6229dc683dbf6eeebd0f9fddc7971ed420", "status": "affected", "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "versionType": "git"}, {"lessThan": "00449d752bee9c8787f42ea1bf533a9fb17f9b6b", "status": "affected", "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "versionType": "git"}, {"lessThan": "47f1441b281decde6954a2fa82b4131637d685ac", "status": "affected", "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/md/raid10.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix still_degraded being inverted in raid10_sync_request()\n\nCommit fe6a19d40ceb (\"md/md-bitmap: merge md_bitmap_start_sync() into\nbitmap_operations\") converted still_degraded from int to bool, but\ninverted the assignment in the loop that checks whether the array will\nstill be degraded after the current device is recovered:\n\"still_degraded = 1\" became \"still_degraded = false\".\n\nAs a result, recovering a device while another mirror is still missing\ncalls md_bitmap_start_sync() with degraded == false, which clears bitmap\nbits that the still-missing device needs. When that device is re-added,\nits bitmap-based recovery finds the bits already cleared and skips every\nregion written while the array was degraded, so it is marked In_sync\nwhile holding stale data: silent corruption.\n\nReproducer (raid10 near=2, 4 disks, internal bitmap):\n - fail and remove one disk of each mirror pair\n - write to the degraded array\n - re-add both disks and let recovery finish\n - \"check\" reports mismatch_cnt=262272 after 256 MiB of degraded\n writes and file contents differ; the second disk's \"recovery\"\n completes in milliseconds because everything is skipped\n\nThe same conversion in raid1 got it right (still_degraded = true).\nRestore the correct value."}], "id": "CVE-2026-89558", "lastModified": "2026-10-19T09:17:51.347", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:19:39.540", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/00449d752bee9c8787f42ea1bf533a9fb17f9b6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0efabe6229dc683dbf6eeebd0f9fddc7971ed420"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47f1441b281decde6954a2fa82b4131637d685ac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel md/raid10: Silent data corruption due to inverted degraded state during array recovery", "id": "2532221", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532221"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-480", "details": ["A flaw was found in the Linux kernel's md/raid10 (RAID10) driver. This vulnerability occurs when a RAID10 array is in a degraded state and a device is being recovered while another mirror is still missing. Due to an inverted boolean value, the system incorrectly clears necessary bitmap bits, causing subsequent recovery operations to skip regions with stale data. This can lead to silent data corruption on the re-added device, impacting data integrity."], "name": "CVE-2026-89558", "public_date": "2026-09-11T19:44:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89558\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89558\nhttps://git.kernel.org/stable/c/00449d752bee9c8787f42ea1bf533a9fb17f9b6b\nhttps://git.kernel.org/stable/c/0efabe6229dc683dbf6eeebd0f9fddc7971ed420\nhttps://git.kernel.org/stable/c/47f1441b281decde6954a2fa82b4131637d685ac\nhttps://git.kernel.org/stable/c/9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe6a19d40ceb44281905485f56dda715e3214e0e,9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe6a19d40ceb44281905485f56dda715e3214e0e,0efabe6229dc683dbf6eeebd0f9fddc7971ed420)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe6a19d40ceb44281905485f56dda715e3214e0e,00449d752bee9c8787f42ea1bf533a9fb17f9b6b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe6a19d40ceb44281905485f56dda715e3214e0e,47f1441b281decde6954a2fa82b4131637d685ac)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T03:30:08.481400+00:00", "updated": "2026-09-15T22:00:17.633785+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}