CVE-2026-90279

md/raid5: round bitmap stripes with sector division

Published Sep 17, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

md/raid5: round bitmap stripes with sector division

raid5_bitmap_sector_map() aligns the array range to full RAID5 stripe
widths before converting it to component sectors. That width is
chunk_sectors multiplied by the number of data disks, and it is not
always a power of two.

Reproduce with a 4-disk RAID5, 1024-sector chunks, and three data disks.
The full-stripe width is 3072 sectors. For a one-sector write at array
sector 3072, correct rounding gives array range [3072, 6144), which maps
to component range [1024, 2048). The old round_down()/round_up() logic
instead gives [1024, 4096), which maps to [0, 1024).

Use sector_div() based arithmetic so the rounded range is aligned to the
actual RAID5 stripe width.

The deterministic mapper test now reports the fixed component range as
[1024, 2048), while the old mask-based range was [0, 1024).

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b29e6400be51c214a0ad30dce937348b57abe33a`	affected	< 9d7490007707f90691911385365bd1d691d99225
`aa8e15d69f5c0044d5bff61844e163aacc4ac172`	affected	< cab7d949b18b2f1cd625689dc16c5f81236bac93
`9c89f604476cf15c31fbbdb043cff7fbf1dbe0cb`	affected	< 02c10581866d08822c6348e299881485fc546185
`9c89f604476cf15c31fbbdb043cff7fbf1dbe0cb`	affected	< ccbdc483eb041eef809e9ff223d1ad63518a2c52
`9c89f604476cf15c31fbbdb043cff7fbf1dbe0cb`	affected	< 17ea021ae74987d6064c8195c4922fa025753892
`a41a0df5d7638acf15e723ad985980b4f7ff9383`	affected	—
`6.6.79`	affected	< 6.6.157
`6.12.13`	affected	< 6.12.110
`6.13.2`	affected	< 6.14

Linux

affected

Version	Status	Constraints
`6.14`	affected	—
`0`	unaffected	< 6.14
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[b29e6400be51c214a0ad30dce937348b57abe33a,9d7490007707f90691911385365bd1d691d99225)`	affected	code_commit	—
`[aa8e15d69f5c0044d5bff61844e163aacc4ac172,cab7d949b18b2f1cd625689dc16c5f81236bac93)`	affected	code_commit	—
`[9c89f604476cf15c31fbbdb043cff7fbf1dbe0cb,02c10581866d08822c6348e299881485fc546185)`	affected	code_commit	—
`[9c89f604476cf15c31fbbdb043cff7fbf1dbe0cb,ccbdc483eb041eef809e9ff223d1ad63518a2c52)`	affected	code_commit	—
`[9c89f604476cf15c31fbbdb043cff7fbf1dbe0cb,17ea021ae74987d6064c8195c4922fa025753892)`	affected	code_commit	—
`a41a0df5d7638acf15e723ad985980b4f7ff9383`	affected	code_commit	—
`[6.6.79,6.6.157)`	affected	semver	—
`[6.12.13,6.12.110)`	affected	semver	—
`[6.13.2,6.14)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.14`	affected	semver	—
`[0,6.14)`	unaffected	semver	—
`[6.6.157,6.7.0]`	unaffected	semver	—
`[6.12.110,6.13.0]`	unaffected	semver	—
`[6.18.52,6.19.0]`	unaffected	semver	—
`[7.2.6,7.3.0]`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.200% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/02c10581866d08822c6348e299881485fc546185
https://git.kernel.org/stable/c/17ea021ae74987d6064c8195c4922fa025753892
https://git.kernel.org/stable/c/9d7490007707f90691911385365bd1d691d99225
https://git.kernel.org/stable/c/cab7d949b18b2f1cd625689dc16c5f81236bac93
https://git.kernel.org/stable/c/ccbdc483eb041eef809e9ff223d1ad63518a2c52

History

Sep 20, 2026 1:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-680 CWE-682

Sep 17, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5_bitmap_sector_map() aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunk_sectors multiplied by the number of data disks, and it is not always a power of two. Reproduce with a 4-disk RAID5, 1024-sector chunks, and three data disks. The full-stripe width is 3072 sectors. For a one-sector write at array sector 3072, correct rounding gives array range [3072, 6144), which maps to component range [1024, 2048). The old round_down()/round_up() logic instead gives [1024, 4096), which maps to [0, 1024). Use sector_div() based arithmetic so the rounded range is aligned to the actual RAID5 stripe width. The deterministic mapper test now reports the fixed component range as [1024, 2048), while the old mask-based range was [0, 1024).
Title		md/raid5: round bitmap stripes with sector division
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/02c10581866d08822c6348e299881485fc546185 https://git.kernel.org/stable/c/17ea021ae74987d6064c8195c4922fa025753892 https://git.kernel.org/stable/c/9d7490007707f90691911385365bd1d691d99225 https://git.kernel.org/stable/c/cab7d949b18b2f1cd625689dc16c5f81236bac93 https://git.kernel.org/stable/c/ccbdc483eb041eef809e9ff223d1ad63518a2c52