GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89558 (GCVE-0-2026-89558)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:30
VLAI
Title
md/raid10: fix still_degraded being inverted in raid10_sync_request()
Summary
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix still_degraded being inverted in raid10_sync_request() Commit fe6a19d40ceb ("md/md-bitmap: merge md_bitmap_start_sync() into bitmap_operations") converted still_degraded from int to bool, but inverted the assignment in the loop that checks whether the array will still be degraded after the current device is recovered: "still_degraded = 1" became "still_degraded = false". As a result, recovering a device while another mirror is still missing calls md_bitmap_start_sync() with degraded == false, which clears bitmap bits that the still-missing device needs. When that device is re-added, its bitmap-based recovery finds the bits already cleared and skips every region written while the array was degraded, so it is marked In_sync while holding stale data: silent corruption. Reproducer (raid10 near=2, 4 disks, internal bitmap): - fail and remove one disk of each mirror pair - write to the degraded array - re-add both disks and let recovery finish - "check" reports mismatch_cnt=262272 after 256 MiB of degraded writes and file contents differ; the second disk's "recovery" completes in milliseconds because everything is skipped The same conversion in raid1 got it right (still_degraded = true). Restore the correct value.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fe6a19d40ceb44281905485f56dda715e3214e0e , < 9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4 (git)
Affected: fe6a19d40ceb44281905485f56dda715e3214e0e , < 0efabe6229dc683dbf6eeebd0f9fddc7971ed420 (git)
Affected: fe6a19d40ceb44281905485f56dda715e3214e0e , < 00449d752bee9c8787f42ea1bf533a9fb17f9b6b (git)
Affected: fe6a19d40ceb44281905485f56dda715e3214e0e , < 47f1441b281decde6954a2fa82b4131637d685ac (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4",
              "status": "affected",
              "version": "fe6a19d40ceb44281905485f56dda715e3214e0e",
              "versionType": "git"
            },
            {
              "lessThan": "0efabe6229dc683dbf6eeebd0f9fddc7971ed420",
              "status": "affected",
              "version": "fe6a19d40ceb44281905485f56dda715e3214e0e",
              "versionType": "git"
            },
            {
              "lessThan": "00449d752bee9c8787f42ea1bf533a9fb17f9b6b",
              "status": "affected",
              "version": "fe6a19d40ceb44281905485f56dda715e3214e0e",
              "versionType": "git"
            },
            {
              "lessThan": "47f1441b281decde6954a2fa82b4131637d685ac",
              "status": "affected",
              "version": "fe6a19d40ceb44281905485f56dda715e3214e0e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix still_degraded being inverted in raid10_sync_request()\n\nCommit fe6a19d40ceb (\"md/md-bitmap: merge md_bitmap_start_sync() into\nbitmap_operations\") converted still_degraded from int to bool, but\ninverted the assignment in the loop that checks whether the array will\nstill be degraded after the current device is recovered:\n\"still_degraded = 1\" became \"still_degraded = false\".\n\nAs a result, recovering a device while another mirror is still missing\ncalls md_bitmap_start_sync() with degraded == false, which clears bitmap\nbits that the still-missing device needs.  When that device is re-added,\nits bitmap-based recovery finds the bits already cleared and skips every\nregion written while the array was degraded, so it is marked In_sync\nwhile holding stale data: silent corruption.\n\nReproducer (raid10 near=2, 4 disks, internal bitmap):\n - fail and remove one disk of each mirror pair\n - write to the degraded array\n - re-add both disks and let recovery finish\n - \"check\" reports mismatch_cnt=262272 after 256 MiB of degraded\n   writes and file contents differ; the second disk\u0027s \"recovery\"\n   completes in milliseconds because everything is skipped\n\nThe same conversion in raid1 got it right (still_degraded = true).\nRestore the correct value."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - md RAID10 commonly backs NAS/SAN volumes exported over NFS, ksmbd, iSCSI, and NVMe-oF. Remote writes during dual-degraded operation dirty the write-intent bitmap, and after buggy recovery remote reads reach md_submit_bio()-\u003eraid10_read_request()-\u003eread_balance() and are served from the stale In_sync mirror without local shell access.\nAC:L - The inverted still_degraded assignment is deterministic in raid10_sync_request() whenever one member is recovered while another remains missing or Faulty. The documented fail/remove/write/re-add sequence needs no race or attacker-uncontrolled memory layout; write-intent bitmaps on RAID10 are a standard mdadm default, not a rare config.\nPR:N - Client I/O to an exported RAID10 LUN needs no Linux UID or host capability: unauthenticated iSCSI/NVMe-oF and guest NFS/SMB writes reach md_submit_bio() and later read stale mirrors. md ioctls/sysfs fail/re-add use capable(CAP_SYS_ADMIN), but hot-spare recovery and storage-protocol I/O do not, so Privileges Required is None rather than High.\nUI:N - No victim click, mount, or confirmation is required. The attacker or automated storage clients issue ordinary reads and writes; md_check_recovery() and md_start_sync() invoke raid10_sync_request() from hot-spare activation or disk re-add as kernel background work.\nS:U - Silent corruption, stale-data disclosure, and volume unavailability remain inside the host kernel and the md RAID10 array. The bug does not escape a VM, bypass an IOMMU, or otherwise cross a separate security authority.\nC:H - raid10_spare_active() sets In_sync on the re-added member while it still holds stale sectors. read_balance() then returns that disk\u0027s prior contents, including previously freed blocks that the current filesystem layout may assign to other users\u0027 or overwritten files, disclosing unauthorized data.\nI:H - md_bitmap_start_sync() is called with degraded=false, clearing NEEDED bits the still-missing mirror requires. That device is marked In_sync after skipping dirty regions; later read-modify-write of the stale data is mirrored to all copies, permanently corrupting filesystem and user data.\nA:H - Stale filesystem metadata served from the wrongly In_sync mirror drives remount-ro, XFS shutdown, or panic on errors=panic, and skipped bitmap recovery leaves dirty regions unrestored, denying availability of the RAID10 volume and any boot or data filesystems on it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:57.786Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0efabe6229dc683dbf6eeebd0f9fddc7971ed420"
        },
        {
          "url": "https://git.kernel.org/stable/c/00449d752bee9c8787f42ea1bf533a9fb17f9b6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/47f1441b281decde6954a2fa82b4131637d685ac"
        }
      ],
      "title": "md/raid10: fix still_degraded being inverted in raid10_sync_request()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89558",
    "datePublished": "2026-09-11T19:44:30.588Z",
    "dateReserved": "2026-09-11T19:38:34.724Z",
    "dateUpdated": "2026-09-13T06:30:57.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89558",
      "date": "2026-09-15",
      "epss": "0.00626",
      "percentile": "0.48183"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89558\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:39.540\",\"lastModified\":\"2026-09-13T07:17:21.907\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmd/raid10: fix still_degraded being inverted in raid10_sync_request()\\n\\nCommit fe6a19d40ceb (\\\"md/md-bitmap: merge md_bitmap_start_sync() into\\nbitmap_operations\\\") converted still_degraded from int to bool, but\\ninverted the assignment in the loop that checks whether the array will\\nstill be degraded after the current device is recovered:\\n\\\"still_degraded = 1\\\" became \\\"still_degraded = false\\\".\\n\\nAs a result, recovering a device while another mirror is still missing\\ncalls md_bitmap_start_sync() with degraded == false, which clears bitmap\\nbits that the still-missing device needs.  When that device is re-added,\\nits bitmap-based recovery finds the bits already cleared and skips every\\nregion written while the array was degraded, so it is marked In_sync\\nwhile holding stale data: silent corruption.\\n\\nReproducer (raid10 near=2, 4 disks, internal bitmap):\\n - fail and remove one disk of each mirror pair\\n - write to the degraded array\\n - re-add both disks and let recovery finish\\n - \\\"check\\\" reports mismatch_cnt=262272 after 256 MiB of degraded\\n   writes and file contents differ; the second disk\u0027s \\\"recovery\\\"\\n   completes in milliseconds because everything is skipped\\n\\nThe same conversion in raid1 got it right (still_degraded = true).\\nRestore the correct value.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/raid10.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fe6a19d40ceb44281905485f56dda715e3214e0e\",\"lessThan\":\"9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe6a19d40ceb44281905485f56dda715e3214e0e\",\"lessThan\":\"0efabe6229dc683dbf6eeebd0f9fddc7971ed420\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe6a19d40ceb44281905485f56dda715e3214e0e\",\"lessThan\":\"00449d752bee9c8787f42ea1bf533a9fb17f9b6b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe6a19d40ceb44281905485f56dda715e3214e0e\",\"lessThan\":\"47f1441b281decde6954a2fa82b4131637d685ac\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/raid10.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00449d752bee9c8787f42ea1bf533a9fb17f9b6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0efabe6229dc683dbf6eeebd0f9fddc7971ed420\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47f1441b281decde6954a2fa82b4131637d685ac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:57:43+00:00",
      "cve": "CVE-2026-89558",
      "id": "CVE-2026-89558",
      "initial_release_date": "2026-09-11T19:44:30.588000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel md/raid10: Silent data corruption due to inverted degraded state during array recovery",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89558.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:02:04Z",
      "cve": "CVE-2026-89558",
      "id": "CVE-2026-89558",
      "initial_release_date": "2026-09-12T16:26:05Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "324",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89558",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89558.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.