CVE-2026-93262: md/raid5-ppl: fix use-after-free in ppl_do_flush()
In the Linux kernel, the following vulnerability has been resolved:
md/raid5-ppl: fix use-after-free in ppldoflush()
The loop in ppldoflush() continues iterating after calling ppliounitfinished(), touching io->pendingflushes and leading to a use-after-free.
Add a break statement to stop the loop once io is freed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add a break statement to ppl_do_flush() so the loop stops iterating once io is freed, preventing access to io->pending_flushes after ppl_io_unit_finished().
Event History
Frequently Asked Questions
Which systems should be prioritized for remediation?
Prioritize Linux systems using the md RAID5 partial parity log (PPL) code path. The defect is in the PPL flush handling routine rather than a general Linux kernel component.
What is the available remediation guidance?
Update to a Linux kernel that includes the upstream fix referenced for this issue. The fix stops the flush loop after the I/O unit is finished, preventing further access to the freed I/O object.