CVE-2026-90279: md/raid5: round bitmap stripes with sector division
In the Linux kernel, the following vulnerability has been resolved:
md/raid5: round bitmap stripes with sector division
raid5bitmapsectormap() aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunksectors multiplied by the number of data disks, and it is not always a power of two.
Reproduce with a 4-disk RAID5, 1024-sector chunks, and three data disks. The full-stripe width is 3072 sectors. For a one-sector write at array sector 3072, correct rounding gives array range [3072, 6144), which maps to component range [1024, 2048). The old rounddown()/roundup() logic instead gives [1024, 4096), which maps to [0, 1024).
Use sectordiv() based arithmetic so the rounded range is aligned to the actual RAID5 stripe width.
The deterministic mapper test now reports the fixed component range as [1024, 2048), while the old mask-based range was [0, 1024).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which RAID layout is shown to be affected by the incorrect alignment logic?
The documented reproduction uses a 4-disk RAID5 array with 1024-sector chunks, giving three data disks and a 3072-sector full-stripe width. This width is not a power of two, which causes mask-based rounding to select the wrong range.
How can I check whether the corrected mapping behavior is present?
For a one-sector write at array sector 3072 in the documented layout, the correct component-sector range is [1024, 2048). The previous logic produced [0, 1024) instead.