CVE-2026-90385: md/raid1: create serial pool adding rdev to array with serialize_policy=1
In the Linux kernel, the following vulnerability has been resolved:
md/raid1: create serial pool adding rdev to array with serializepolicy=1
The following bug has been observed with kernel 7.1.3 after adding a new rdev to an existing RAID1 array with serializepolicy enabled:
Oops: 0002 [#1] CPU: 0 UID: 0 PID: 19639 Comm: ext4lazyinit Not tainted 7.1.3-1-default RIP: rawspinlockirqsave+0x27/0x50 CR2: 0000000000004960 Call Trace: waitforserialization+0xb9/0x260 [raid1] raid1makerequest+0x762/0xaff [raid1] mdhandlerequest+0x1c9/0x2e0 [mdmod]
The raid1.c code calls waitforserialization() if the MDSERIALIZEPOLICY is set, and waitforserialization assumes that rdev->serial is initialized. Normally this will be the case for arrays that have the serializepolicy sysfs attribute set to 1.
But when a new rdev is added to an existing array in bindrdevtoarray(), the condition at mddevcreateserialpool() causes creation of rdev->serial to be skipped. Fix it.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems with an existing Linux MD RAID1 array that has the serialize_policy sysfs attribute enabled and then has a new RAID device (rdev) added are exposed. The described failure occurs because the added device may not receive its required serialization state.
What action triggers the failure?
Adding a new rdev to an existing RAID1 array while serialize_policy is set to 1 can trigger the issue when RAID1 I/O reaches wait_for_serialization(). The reported outcome is a kernel oops in the RAID1 request path.
Are RAID1 arrays affected by default?
The available information only identifies arrays with serialize_policy enabled as affected. It does not establish that the policy is enabled by default.
What can be done before applying the fix?
Avoid adding new rdev devices to existing RAID1 arrays while serialize_policy is enabled. The provided information does not describe another mitigation or a safe procedure for initializing the missing serialization state.