CVE-2026-90401 Linux CVE debrief

Who should care

Defenders and system administrators responsible for Linux kernel configurations, especially those using raid1, raid10, or raid456, should assess exposure and prioritize verification and patching.

Why it matters

CVE-2026-90401 is a Linux kernel vulnerability that was resolved by removing REQ_NOWAIT support from raid1, raid10, and raid456. Defenders should assess exposure and prioritize verification and patching.

• Verify Linux kernel configurations for potential exposure
• Assess system logs for potential issues related to the vulnerability
• Prioritize patching or mitigation for systems using raid1, raid10, or raid456

Technical summary

The Linux kernel vulnerability CVE-2026-90401 was resolved by removing REQ_NOWAIT support from raid1, raid10, and raid456. This change addresses issues with REQ_NOWAIT support in md personalities that can block internally, which could lead to divergent data in mirrors. The vulnerability affects Linux kernel configurations using raid1, raid10, or raid456. Defenders should assess exposure and prioritize verification of Linux kernel configurations, especially for systems using raid1, raid10, or raid456. The removal of REQ_NOWAIT support from raid1, raid10, and raid456 ensures that md personalities can no longer block internally, preventing divergent data in mirrors.

Defensive priority

Defenders should assess exposure and prioritize verification of Linux kernel configurations, especially for systems using raid1, raid10, or raid456.

Recommended defensive actions

• Assess Linux kernel configurations for raid1, raid10, or raid456 usage
• Verify system exposure and prioritize patching or mitigation
• Monitor system logs for potential issues related to the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its resolution. However, additional information on affected systems and exploitation attempts is limited. Defenders should verify Linux kernel configurations for potential exposure, assess system logs for potential issues related to the vulnerability, and prioritize patching or mitigation for systems using raid1, raid10, or raid456. The removal of REQ_NOWAIT support from raid1, raid10, and raid456 addresses issues with REQ_NOWAIT support in md personalities that can

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.