CVE-2026-90389: md: scope memalloc_noio to allocation critical sections
In the Linux kernel, the following vulnerability has been resolved:
md: scope memallocnoio to allocation critical sections
Storing a memallocnoiosave() token in mddev->noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter PFMEMALLOCNOIO, return to userspace still in that scope, and later task B can restore A's saved token.
Avoid tying the token lifetime to mddev. Keep mddevsuspend() and mddevresume() only responsible for array suspension, and enter PFMEMALLOCNOIO only in the MD paths that allocate memory after the array has been suspended. Restore the token before resuming the array.
A reproducer repeatedly writes suspendlo and suspendhi from concurrent workers and checks each worker's /proc/self/stat flags before and after the sysfs write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems where concurrent workers can write the MD suspend_lo and suspend_hi sysfs controls are exposed to the race. The issue involves one task saving a memalloc_noio token and another task restoring it.
What access is needed to trigger the problem?
An attacker or local process needs to perform concurrent writes to the suspend_lo and suspend_hi sysfs attributes for an MD array. The reproducer repeatedly performs those writes from concurrent workers.
How can I check whether the issue is occurring?
Run concurrent workers that repeatedly write suspend_lo and suspend_hi, then compare each worker's /proc/self/stat flags before and after its sysfs write. A worker retaining PF_MEMALLOC_NOIO after returning from the write indicates the problematic scope leakage.