UBUNTU-CVE-2026-90389: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: md: scope memallocnoio to allocation critical sections Storing a memallocnoiosave() token in mddev->noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter PFMEMALLOCNOIO, return to userspace still in that scope, and later task B can restore A's saved token. Avoid tying the token lifetime to mddev. Keep mddevsuspend() and mddevresume() only responsible for array suspension, and enter PFMEMALLOCNOIO only in the MD paths that allocate memory after the array has been suspended. Restore the token before resuming the array. A reproducer repeatedly writes suspendlo and suspendhi from concurrent workers and checks each worker's /proc/self/stat flags before and after the sysfs write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running one of the listed Ubuntu kernel packages and using MD arrays are exposed to the affected code path. The issue is triggered through concurrent writes to the MD array suspension sysfs controls.
What does an attacker or local user need to do to trigger it?
They need to repeatedly and concurrently write the suspend_lo and suspend_hi sysfs attributes for an MD array. The race can cause one task to retain the PF_MEMALLOC_NOIO state after returning to userspace while another task restores that task's saved state.
How can I check for attempted or successful triggering?
A reproducer checks each concurrent worker's /proc/self/stat flags before and after its sysfs write to identify PF_MEMALLOC_NOIO state that remains set unexpectedly. The provided information does not specify a persistent system log indicator.