PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45888 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's RAID1 (md/raid1) implementation. The flaw occurs in raid1_run() when setup_conf() successfully registers a thread via md_register_thread(), but a subsequent call to raid1_set_limits() fails. In this error path, the previously registered thread is not unregistered, resulting in a memory leak of both the md_thread structure and the associated thread resource. The vulnerability was identified through prototype static analysis and code review, with a fix implemented by adding md_unregister_thread() to the error path to align with existing error handling patterns in the function. The fix has been applied to multiple stable kernel branches.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

System administrators running Linux systems with software RAID1 (mdraid) configurations, kernel maintainers, and security teams responsible for Linux infrastructure patching.

Technical summary

The vulnerability is a memory leak in the Linux kernel's RAID1 device mapper (md/raid1). In raid1_run(), the function setup_conf() registers a kernel thread via md_register_thread(). If the subsequent raid1_set_limits() call fails, the error path did not previously unregister the thread, leaking the md_thread structure and thread resource. The fix adds md_unregister_thread() to this error path for proper cleanup.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the fix commits for affected stable kernel branches
  • Monitor kernel vendor security advisories for distribution-specific patch availability
  • Review systems utilizing md/raid1 for kernel version inventory
  • Consider rebooting after kernel update to ensure patched code is active

Evidence notes

The vulnerability description indicates the issue was found using a prototype static analysis tool and code review, with compile testing performed. The fix adds proper cleanup via md_unregister_thread() in the error path when raid1_set_limits() fails after thread registration. Multiple kernel stable branch commits are referenced, indicating backporting to supported kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45888 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45888

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45888 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45888

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6abc7d5dcf0ee0f85e16e41c87fbd06231f28753

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b37588b0282a2b3cdda9db1d53712745ce66dea0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c94fd6e8a71efd047ff36930e840f3c25679e136

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ec10e3dc93994b87adf7c759a4639fe34013989a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.