CVE-2026-90389: md: scope memalloc_noio to allocation critical sections

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

md: scope memallocnoio to allocation critical sections

Storing a memallocnoiosave() token in mddev->noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter PFMEMALLOCNOIO, return to userspace still in that scope, and later task B can restore A's saved token.

Avoid tying the token lifetime to mddev. Keep mddevsuspend() and mddevresume() only responsible for array suspension, and enter PFMEMALLOCNOIO only in the MD paths that allocate memory after the array has been suspended. Restore the token before resuming the array.

A reproducer repeatedly writes suspendlo and suspendhi from concurrent workers and checks each worker's /proc/self/stat flags before and after the sysfs write.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 17, 2026
CVE Published
via MITRE·04:09 PM
Data Sourced
via MITRE·04:09 PM
Description

Frequently Asked Questions

1

Who is exposed to this issue?

Systems where concurrent workers can write the MD suspend_lo and suspend_hi sysfs controls are exposed to the race. The issue involves one task saving a memalloc_noio token and another task restoring it.

2

What access is needed to trigger the problem?

An attacker or local process needs to perform concurrent writes to the suspend_lo and suspend_hi sysfs attributes for an MD array. The reproducer repeatedly performs those writes from concurrent workers.

3

How can I check whether the issue is occurring?

Run concurrent workers that repeatedly write suspend_lo and suspend_hi, then compare each worker's /proc/self/stat flags before and after its sysfs write. A worker retaining PF_MEMALLOC_NOIO after returning from the write indicates the problematic scope leakage.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203