CVE-2026-43309

Description

In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions. This occurs when: - A dm-raid managed device tree is suspended from top to bottom (the top-level RAID device is suspended first, followed by its underlying metadata and data devices) - The top-level RAID device is then removed Removing the top-level device triggers a hang in the following sequence: the dm-raid destructor calls md_stop(), which tries to flush the write-intent bitmap by writing to the metadata sub-devices. However, these devices are already suspended, making them unable to complete the write-intent operations and causing an indefinite block. Fix: - Prevent bitmap flushing when md_stop() is called from dm-raid destructor context and avoid a quiescing/unquescing cycle which could also cause I/O - Still allow write-intent bitmap flushing when called from dm-raid suspend context This ensures that RAID array teardown can complete successfully even when the underlying devices are in a suspended state. This second patch uses md_is_rdwr() to distinguish between suspend and destructor paths as elaborated on above.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (Mainline)

Linux Kernel (Stable branches, see patch commit 24783dd06de8)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC for CVE-2026-43309: Linux Kernel md-raid Hang
 * This is a conceptual reproduction of the vulnerability trigger.
 * Requires root privileges to setup dm-raid devices.
 */

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>

// Simplified pseudo-code to demonstrate the sequence
void trigger_vulnerability() {
    // Step 1: Setup dm-raid managed device (omitted details for brevity)
    printf("[+] Setting up dm-raid device...\n");
    // system("dmsetup create raid_array --table \"...\"");

    // Step 2: Suspend the device tree from top to bottom
    // This suspends the top-level RAID device and underlying metadata devices
    printf("[+] Suspending device tree (top-down)...\n");
    // system("dmsetup suspend raid_array");

    // Step 3: Remove the top-level RAID device
    // This triggers md_stop() in the destructor context
    printf("[+] Removing top-level device...\n");
    // system("dmsetup remove raid_array");

    // System should hang here as md_stop() tries to flush bitmap to suspended devices
    printf("[-] System hung attempting to flush bitmap to suspended metadata.\n");
}

int main() {
    trigger_vulnerability();
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43309
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43309
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43309/
[4] VulDB https://vuldb.com/cve/CVE-2026-43309
[5] https://git.kernel.org/stable/c/24783dd06de870d646c25207bae186f78195f912
[6] https://git.kernel.org/stable/c/338378dfffbdbb8d37a18f0a0c0358812671f91e
[7] https://git.kernel.org/stable/c/cefcb9297fbdb6d94b61787b4f8d84f55b741470

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43309", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-08T14:16:38.250", "lastModified": "2026-05-15T17:58:45.027", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd raid: fix hang when stopping arrays with metadata through dm-raid\n\nWhen using device-mapper's dm-raid target, stopping a RAID array can cause\nthe system to hang under specific conditions.\n\nThis occurs when:\n\n- A dm-raid managed device tree is suspended from top to bottom\n (the top-level RAID device is suspended first, followed by its\n underlying metadata and data devices)\n\n- The top-level RAID device is then removed\n\nRemoving the top-level device triggers a hang in the following sequence:\nthe dm-raid destructor calls md_stop(), which tries to flush the\nwrite-intent bitmap by writing to the metadata sub-devices. However, these\ndevices are already suspended, making them unable to complete the write-intent\noperations and causing an indefinite block.\n\nFix:\n\n- Prevent bitmap flushing when md_stop() is called from dm-raid\ndestructor context\n and avoid a quiescing/unquescing cycle which could also cause I/O\n\n- Still allow write-intent bitmap flushing when called from dm-raid\nsuspend context\n\nThis ensures that RAID array teardown can complete successfully even when the\nunderlying devices are in a suspended state.\n\nThis second patch uses md_is_rdwr() to distinguish between suspend and\ndestructor paths as elaborated on above."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.292", "versionEndExcluding": "4.15", "matchCriteriaId": "90B7818C-A8A5-4C02-A732-1CDB5825A096"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.257", "versionEndExcluding": "4.20", "matchCriteriaId": "CC49E974-39F0-4EAB-AA56-2136CE9885A8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.212", "versionEndExcluding": "5.5", "matchCriteriaId": "1FF42D15-4929-4BA3-A853-6ED272405AD4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.140", "versionEndExcluding": "5.11", "matchCriteriaId": "61324615-2233-4AFB-B3E2-0703FED36D4A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.64", "versionEndExcluding": "5.16", "matchCriteriaId": "B81924EA-65D3-4820-9B92-35D59FC2A466"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19.6", "versionEndExcluding": "6.0", "matchCriteriaId": "6E53B030-2C91-45B9-91A0-63E897460E68"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.1", "versionEndExcluding": "6.18.16", "matchCriteriaId": "03E689D3-2167-43C7-81EB-609E36C5A388"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:-:*:*:*:*:*:*", "matchCriteriaId": "7BE551E5-89CF-47A8-9B26-03CE727FBA37"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "A46498B3-78E1-4623-AAE1-94D29A42BE4E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "F8446E87-F5F6-41CA-8201-BAE0F0CA6DD9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "8E5FB72F-67CE-43CC-83FE-541604D98182"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "3A0A7397-F5F8-4753-82DC-9A11288E696D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "E6DE049A-ABA8-41DD-988C-8C088358EE9B"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/24783dd06de870d646c25207bae186f78195f912", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patc ... (truncated)