CVE-2026-46050: Linux Kernel Race Condition Vulnerability

CVE-2026-46050 Overview

CVE-2026-46050 is a denial-of-service vulnerability in the Linux kernel's md/raid10 subsystem. The flaw causes a deadlock when an array check operation runs concurrently with NOWAIT I/O requests on the same RAID10 array. The nr_pending counter underflows because allow_barrier() unconditionally decrements it, even when the corresponding increment was skipped for NOWAIT requests that returned immediately. The md resync thread then waits indefinitely for nr_pending to reach zero, stalling the array.

Critical Impact
A local workload combining NOWAIT I/O with an md array check can deadlock the RAID10 stack, blocking writeback and resync threads and rendering the array unresponsive.

Affected Products

Linux kernel versions containing commit 43806c3d5b9b ("raid10: cleanup memleak at raid10_make_request") without the fix
Systems using md/raid10 software RAID arrays
Linux stable trees prior to the patched commits listed in the kernel.org references

Discovery Timeline

2026-05-27 - CVE-2026-46050 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46050

Vulnerability Analysis

The defect lives in the synchronization logic between the md resync thread and the I/O submission path in drivers/md/raid10.c. When an array check raises the barrier, normal requests block inside wait_barrier() and increment conf->nr_pending to signal pending work. NOWAIT requests intentionally do not block. They return an error without incrementing nr_pending.

Commit 43806c3d5b9b added a call to raid_end_bio_io() to fix a memory leak in the NOWAIT path. However, raid_end_bio_io() eventually invokes allow_barrier(), which calls atomic_dec_and_test(&conf->nr_pending) without checking whether the matching increment ever occurred. The counter underflows to a negative value.

Diagnostic output from a deadlocked array shows nr_pending.counter = -41 and nr_waiting = 15. The md_resync thread is stuck in raise_barrier() waiting for nr_pending to reach zero, while writeback workers are blocked in wait_barrier(). The condition is classified as a race condition leading to denial of service.

Root Cause

The root cause is an asymmetric reference-count update on conf->nr_pending. The NOWAIT fast-fail path skips the increment in wait_barrier() but still flows through raid_end_bio_io() and allow_barrier(), which performs an unconditional decrement. The counter then drifts negative whenever NOWAIT requests collide with a raised barrier.

Attack Vector

The vector is local. An unprivileged or privileged workload issuing NOWAIT I/O, such as io_uring with IOCB_NOWAIT or direct I/O with RWF_NOWAIT, against a RAID10 array while a check or repair operation is active reliably triggers the underflow. No remote network exposure exists. The result is a persistent deadlock of the array's md threads until reboot.

The vulnerability is described in the kernel commit log referenced in the Linux Kernel Commit Update. No exploitation code is required beyond standard NOWAIT I/O syscalls.

Detection Methods for CVE-2026-46050

Indicators of Compromise

Negative or wildly inaccurate value in conf->nr_pending for an md RAID10 array, visible via crash dump or /sys/block/mdX/md/ introspection.
md_resync kernel thread blocked in raise_barrier+0xce/0x1c0 with no forward progress.
Writeback workers blocked in wait_barrier+0x1de/0x220 followed by regular_request_wait and raid10_make_request.
Hung-task warnings naming md1_resync or similar md threads after starting an array check.

Detection Strategies

Enable CONFIG_DETECT_HUNG_TASK and monitor dmesg for hung-task stack traces matching raid10_make_request and md_do_sync.
Use cat /proc/mdstat to detect a check that stalls at a fixed percentage while the array stops accepting writes.
Sample running kernel stacks of md threads via /proc/<pid>/stack during periods of suspected I/O stalls.

Monitoring Recommendations

Track kernel version inventory across hosts using software RAID10 and flag systems missing the upstream fix commits referenced on kernel.org.
Alert on sustained I/O latency or queue depth growth on /dev/mdX block devices during scheduled array checks.
Forward dmesg and journalctl -k output to a central log store and create rules for INFO: task ... blocked for more than messages referencing md threads.

How to Mitigate CVE-2026-46050

Immediate Actions Required

Update the Linux kernel to a stable release containing the fix commits listed in the kernel.org references.
Avoid scheduling md array check or repair operations on RAID10 arrays serving NOWAIT I/O workloads until patched.
If a deadlock occurs, reboot the affected host. The nr_pending underflow cannot be recovered at runtime.

Patch Information

The fix is delivered through a series of stable-tree commits that correct the asymmetric reference counting in the NOWAIT path. Apply the kernel update that includes the changes referenced in the Linux Kernel Commit 42fe37c9, Commit 1cdff293, Commit 7d96f312, Commit 965d6162, and Commit cac2106b. Coordinate with your distribution vendor for the corresponding backport.

Workarounds

Pause or disable periodic md check operations on RAID10 arrays via echo idle > /sys/block/mdX/md/sync_action until the kernel is patched.
Disable NOWAIT-issuing workloads such as io_uring-based applications on affected arrays during maintenance windows.
Migrate critical workloads to arrays not running concurrent check operations until the fix is deployed.

bash

# Configuration example: stop an in-progress md check to avoid triggering the deadlock
echo idle > /sys/block/md0/md/sync_action

# Verify current sync state
cat /sys/block/md0/md/sync_action
cat /proc/mdstat