CVE-2026-45953 Linux CVE debrief

Who should care

System administrators managing Linux software RAID5 arrays, particularly those using write-intent bitmaps for resync acceleration. Organizations running storage servers or virtualized infrastructure on kernel-based RAID configurations. Kernel maintainers and Linux distribution security teams responsible for stable kernel updates.

Technical summary

The vulnerability exists in the md/raid5 driver when handling stripes on degraded arrays using the lazy-latency bitmap (llbitmap) feature. The code path through `handle_stripe_dirtying()` correctly checks `bitmap_ops->blocks_synced()` to force reconstruct-write (rcw) operations when bitmap bits are unwritten. However, `need_this_block()` lacks this check, causing it to return zero in scenarios where stripe filling is required. This creates a livelock: `handle_stripe()` dispatches to `handle_stripe_fill()`, but `need_this_block()` prevents any block processing, resulting in indefinite I/O stalls. The fix adds the missing bitmap synchronization check to `need_this_block()` to maintain consistency with `handle_stripe_dirtying()` logic.

Defensive priority

medium

Recommended defensive actions

• Apply kernel updates from stable branches containing commits 28ef299e7a5b, 870b9f15867b, or cd1635d844d2 as appropriate for your kernel version
• Monitor RAID array health and avoid running RAID5 arrays in degraded state when possible
• Review dmesg logs for md/raid5 stripe handling errors that may indicate this condition
• Consider disabling write-intent bitmaps temporarily on degraded RAID5 arrays if patching is delayed and I/O hangs are observed
• Validate RAID5 array integrity after applying patches and before returning to production workloads

Evidence notes

Vulnerability description sourced from official CVE record published 2026-05-27. Root cause analysis derived from kernel commit messages in stable tree references. Affected component identified as md/raid5 subsystem with llbitmap (lazy-latency bitmap) configuration. Fix commits verified in kernel.org stable repository.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.