CVE-2026-46051 Overview
CVE-2026-46051 is a Linux kernel vulnerability in the md/raid5 driver. The flaw resides in the retry_aligned_read() function, which mishandles stripe release when encountering an overlapped stripe. The incorrect release path routes the stripe through the released_stripes llist, causing it to be removed from handle_list before handle_stripe() can process the overlap. The result is an infinite loop in raid5d and a soft lockup of the system.
Critical Impact
An overlapped stripe condition in RAID5 arrays can trigger an unrecoverable soft lockup in the kernel, leading to denial of service on affected Linux systems running software RAID5.
Affected Products
- Linux kernel (mainline) with md/raid5 driver enabled
- Stable kernel branches receiving the backported fixes referenced in the patch series
- Distributions shipping vulnerable md/raid5 code prior to applying the upstream commits
Discovery Timeline
- 2026-05-27 - CVE-2026-46051 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46051
Vulnerability Analysis
The vulnerability is a [Race Condition] in the Linux software RAID5 implementation that leads to an infinite loop and CPU soft lockup. When retry_aligned_read() encounters an overlapped stripe, it releases the stripe via raid5_release_stripe(). That helper places the stripe on the lockless released_stripes llist for later draining.
On the next raid5d loop iteration, release_stripe_list() drains the stripe onto handle_list because STRIPE_HANDLE was set by the original I/O. However, retry_aligned_read() executes before handle_active_stripes() and removes the same stripe from handle_list through find_get_stripe() -> list_del_init(). This ordering prevents handle_stripe() from ever processing the stripe to resolve the overlap.
With the overlap never resolved, raid5d cannot make forward progress and continuously revisits the same stripe. The kernel watchdog ultimately reports a soft lockup on the CPU executing the RAID5 daemon.
Root Cause
The root cause is the use of raid5_release_stripe() in the failure path of retry_aligned_read(). Routing the stripe through the lockless released list creates a window where the stripe is re-added to handle_list and then immediately removed again by the retry path, defeating the normal stripe-handling state machine.
Attack Vector
The condition is triggered by I/O patterns that produce overlapping stripes on a RAID5 array during aligned read retry. Triggering the lockup requires legitimate or crafted block-layer activity against an md/raid5 device. No remote network access is involved; impact is local denial of service on the host running the array.
The upstream fix replaces raid5_release_stripe() with __release_stripe() using temp_inactive_list in the failure path. This keeps the stripe off the released_stripes llist, allows raid5d to break out of its loop, and ensures the overlap is resolved when handle_stripe() next processes the stripe.
Detection Methods for CVE-2026-46051
Indicators of Compromise
- Kernel log entries containing watchdog: BUG: soft lockup - CPU#X stuck with stack traces pointing to raid5d, retry_aligned_read, or handle_stripe.
- Sustained 100% CPU usage by the md kernel thread associated with a RAID5 array.
- Stalled or hung I/O on block devices backed by an md/raid5 array.
Detection Strategies
- Monitor dmesg and /var/log/messages for soft lockup warnings referencing RAID5 symbols in the call trace.
- Compare running kernel versions against the fixed commits 09880592, 1985cb32, 7f9f7c69, 80fc6ca2, and 883cc33b to identify unpatched hosts.
- Track block I/O latency and queue depth on md devices to surface stalls characteristic of the looping condition.
Monitoring Recommendations
- Forward kernel ring buffer events into a centralized log platform and alert on soft lockup and raid5d keyword patterns.
- Instrument node exporters or equivalent agents to alert on per-CPU iowait and kernel thread CPU pinning anomalies.
- Maintain an inventory of kernel build versions and md configuration across the fleet to scope exposure quickly.
How to Mitigate CVE-2026-46051
Immediate Actions Required
- Apply vendor-provided kernel updates that include the upstream md/raid5 fix to all hosts using software RAID5.
- Reboot affected systems after updating to ensure the patched kernel is active.
- Prioritize patching on storage servers, database hosts, and any node where availability of md/raid5 arrays is critical.
Patch Information
The fix is available in the upstream Linux kernel through the following stable commits: Linux Kernel Patch 09880592, Linux Kernel Patch 1985cb32, Linux Kernel Patch 7f9f7c69, Linux Kernel Patch 80fc6ca2, and Linux Kernel Patch 883cc33b. The patches replace raid5_release_stripe() with __release_stripe() and temp_inactive_list in the failure path of retry_aligned_read().
Workarounds
- Where feasible, migrate critical workloads off md/raid5 to RAID levels not affected by this code path until patches are deployed.
- Reduce concurrent write workloads that produce overlapping stripes on RAID5 arrays on unpatched hosts to lower the probability of triggering the lockup.
- Configure kernel softlockup_panic and remote watchdog policies to ensure timely failover when a lockup occurs in clustered environments.
# Identify running kernel and md devices to scope exposure
uname -r
cat /proc/mdstat
# Check kernel log for prior RAID5 soft lockup events
dmesg | grep -E 'soft lockup|raid5d|retry_aligned_read'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
