UBUNTU-CVE-2026-90400: Null Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares() and removeandaddspares() modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync() checks whether spare configuration changes are needed before taking reconfigmutex. However, the rdev state can change before the mutex is acquired, so the initial check can become stale. In that case, mdchoosesyncaction() may remove or replace rdevs while normal I/O is still accessing them. The race can occur as follows: raid10d Worker Normal IO raid10writerequest() waitblockeddev() set Blocked set Faulty Skip Faulty rdev rrdev->nrpending++ .replbio = bio removeablerdev = false . array not suspended . lock mddev goto errhandle lock mddev (wait) . update sb . clear Blocked . . unlock mddev . lock mddev (acquires) removespares() removeablerdev = true raid10removedisk() rdev = replacement replacement = NULL rdevdecpending(NULL) unlock mddev (NULL)->nrpending-- In this case, rdevdecpending() is called with a NULL pointer, resulting in a NULL pointer dereference when attempting to decrement nrpending. Fix this by suspending the array when spare configuration changes are needed, including for non-read-write arrays, and checking again after taking reconfigmutex. If the array was not already suspended and a change is now needed, release the mutex, suspend the array, and reacquire the mutex before continuing.