UBUNTU-CVE-2026-90275: Medium severity ubuntu/linux-hwe-edge vulnerability

Q: What systems are exposed to this issue?

Systems using the listed Ubuntu kernel packages may be affected when an MD array is taken over into RAID1. The failure occurs after the takeover leaves the RAID1 configuration's array_frozen flag set.

Q: What is the operational impact if the issue is triggered?

Every I/O to the affected array can stall permanently once the RAID1 barrier wait observes array_frozen still set. This is an availability problem for the affected MD array.

Q: Is a normal RAID1 array necessarily affected?

The described trigger is raid1_takeover(), so the provided data identifies RAID1 takeover operations as the relevant condition. It does not state that ordinary RAID1 operation without a takeover triggers the problem.

Q: What change made the issue persist?

The problem became persistent after commit b39f35ebe86d removed the quiesce call that had cleared array_frozen after the RAID1 personality was started. As a result, the value set during takeover was no longer reset.

Published Sep 17, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set arrayfrozen in raid1takeover() raid1takeover() sets conf->arrayfrozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once waitbarrier() sees it stuck at 1. This used to be harmless: levelstore() called mddevresume() right after pers->run(), which called raid1quiesce(mddev, 0) and cleared arrayfrozen back to 0 regardless of what raid1takeover() set. Commit b39f35ebe86d ("md: don't quiesce in mddevsuspend()") removed that quiesce(mddev, 0) call, so the pre-set now sticks. setupconf() already zero-initializes the new r1conf via kzalloc, so just don't set arrayfrozen here. Same class of bug as commit 892da88d1cd9 ("md/raid10: fix a 'conf->barrier' leakage in raid10takeover()"), also triggered by b39f35ebe86d.

Affected Software

161 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm-6.8*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0*

ubuntu/linux-azure*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0*

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-42.42~24.04.1

7.0.0-42.42~24.04.1

ubuntu/linux-ibm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0*

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0*

ubuntu/linux-raspi*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-42.42.1~24.04.1

7.0.0-42.42.1~24.04.1

ubuntu/linux-xilinx*

ubuntu/linux-bluefield*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<7.0.0-42.42

7.0.0-42.42

ubuntu/linux-aws<7.0.0-1016.17

7.0.0-1016.17

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<7.0.0-1016.18

7.0.0-1016.18

ubuntu/linux-gke*

ubuntu/linux-ibm<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos*

ubuntu/linux-oem-7.0<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-oracle<7.0.0-1015.16

7.0.0-1015.16

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv<7.0.0-42.42.1

7.0.0-42.42.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.17
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.18
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.16
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42.1

Event History

Sep 17, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What systems are exposed to this issue?

Systems using the listed Ubuntu kernel packages may be affected when an MD array is taken over into RAID1. The failure occurs after the takeover leaves the RAID1 configuration's array_frozen flag set.

What is the operational impact if the issue is triggered?

Every I/O to the affected array can stall permanently once the RAID1 barrier wait observes array_frozen still set. This is an availability problem for the affected MD array.

Is a normal RAID1 array necessarily affected?

The described trigger is raid1_takeover(), so the provided data identifies RAID1 takeover operations as the relevant condition. It does not state that ordinary RAID1 operation without a takeover triggers the problem.

What change made the issue persist?

The problem became persistent after commit b39f35ebe86d removed the quiesce call that had cleared array_frozen after the RAID1 personality was started. As a result, the value set during takeover was no longer reset.

UBUNTU-CVE-2026-90275: Medium severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What systems are exposed to this issue?

What is the operational impact if the issue is triggered?

Is a normal RAID1 array necessarily affected?

What change made the issue persist?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this issue?

What is the operational impact if the issue is triggered?

Is a normal RAID1 array necessarily affected?

What change made the issue persist?