CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid
In the Linux kernel, the following vulnerability has been resolved:
md raid: fix hang when stopping arrays with metadata through dm-raid
When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions.
This occurs when:
- A dm-raid managed device tree is suspended from top to bottom (the top-level RAID device is suspended first, followed by its underlying metadata and data devices)
- The top-level RAID device is then removed
Removing the top-level device triggers a hang in the following sequence: the dm-raid destructor calls mdstop(), which tries to flush the write-intent bitmap by writing to the metadata sub-devices. However, these devices are already suspended, making them unable to complete the write-intent operations and causing an indefinite block.
Fix:
- Prevent bitmap flushing when mdstop() is called from dm-raid destructor context and avoid a quiescing/unquescing cycle which could also cause I/O
- Still allow write-intent bitmap flushing when called from dm-raid suspend context
This ensures that RAID array teardown can complete successfully even when the underlying devices are in a suspended state.
This second patch uses mdisrdwr() to distinguish between suspend and destructor paths as elaborated on above.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.6-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.16 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43309?
The severity of CVE-2026-43309 is medium with a CVSS score of 5.5.
How do I fix CVE-2026-43309?
To fix CVE-2026-43309, apply the available patch for the Linux kernel.
What systems are affected by CVE-2026-43309?
CVE-2026-43309 affects systems using the Linux kernel that utilize device-mapper's dm-raid target.
What does CVE-2026-43309 do?
CVE-2026-43309 causes a system hang when stopping RAID arrays with metadata under certain conditions.
When was CVE-2026-43309 published?
CVE-2026-43309 was published on May 8, 2026.