PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45888 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's RAID1 (md/raid1) implementation. The flaw occurs in raid1_run() when setup_conf() successfully registers a thread via md_register_thread(), but a subsequent call to raid1_set_limits() fails. In this error path, the previously registered thread is not unregistered, resulting in a memory leak of both the md_thread structure and the associated thread resource. The vulnerability was identified through prototype static analysis and code review, with a fix implemented by adding md_unregister_thread() to the error path to align with existing error handling patterns in the function. The fix has been applied to multiple stable kernel branches.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

System administrators running Linux systems with software RAID1 (mdraid) configurations, kernel maintainers, and security teams responsible for Linux infrastructure patching.

Technical summary

The vulnerability is a memory leak in the Linux kernel's RAID1 device mapper (md/raid1). In raid1_run(), the function setup_conf() registers a kernel thread via md_register_thread(). If the subsequent raid1_set_limits() call fails, the error path did not previously unregister the thread, leaking the md_thread structure and thread resource. The fix adds md_unregister_thread() to this error path for proper cleanup.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the fix commits for affected stable kernel branches
  • Monitor kernel vendor security advisories for distribution-specific patch availability
  • Review systems utilizing md/raid1 for kernel version inventory
  • Consider rebooting after kernel update to ensure patched code is active

Evidence notes

The vulnerability description indicates the issue was found using a prototype static analysis tool and code review, with compile testing performed. The fix adds proper cleanup via md_unregister_thread() in the error path when raid1_set_limits() fails after thread registration. Multiple kernel stable branch commits are referenced, indicating backporting to supported kernel versions.

Official resources

2026-05-27