CVE-2026-46161: Linux Kernel RAID10 DoS Vulnerability

CVE-2026-46161 Overview

CVE-2026-46161 is a divide-by-zero flaw in the Linux kernel's md/raid10 driver. The setup_geo() function extracts near_copies (nc) and far_copies (fc) values from a user-supplied layout parameter without validating them against zero. When fc=0 is combined with the improved far set layout, the calculation geo->far_set_size = disks / fc triggers a divide-by-zero condition in kernel space. The upstream fix validates both nc and fc immediately after extraction, returning -1 when either is zero. The issue affects Linux kernel branches that include the affected RAID10 geometry setup logic.

Critical Impact
A local user able to assemble or configure a RAID10 array can trigger a kernel divide-by-zero, causing a denial-of-service condition on the affected host.

Affected Products

Linux kernel md/raid10 driver
Stable kernel branches referenced by commits 4af2e558e6fd, 913d556e4bd1, 9aa6d860b093, 9d8e03b9a2b1, and f9ddb621b232
Distributions shipping unpatched Linux kernels with the affected RAID10 setup code

Discovery Timeline

2026-05-28 - CVE-2026-46161 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46161

Vulnerability Analysis

The vulnerability lives in the RAID10 geometry initialization path within the Linux kernel's multiple-device (md) subsystem. The setup_geo() function parses a layout integer supplied by userspace and decodes it into near_copies and far_copies fields that describe how data is mirrored across disks. The parser does not enforce a minimum value of one for these fields before they are used as divisors. When the improved far set layout is selected and far_copies equals zero, the expression geo->far_set_size = disks / fc divides by zero. On the Linux kernel this raises a processor exception that the kernel handles as an oops, terminating the calling context and potentially destabilizing the host.

Root Cause

The root cause is missing input validation on attacker-controlled integer fields used as divisors. The fix adds an explicit check that returns -1 from setup_geo() if either nc or fc is zero, rejecting the layout before any arithmetic uses the value. This is a classic divide-by-zero defect [CWE-369] arising from trusting userspace-provided geometry parameters.

Attack Vector

Exploitation requires the ability to assemble or reshape a RAID10 array, which is typically restricted to privileged users such as root or accounts holding CAP_SYS_ADMIN. An actor with that capability can craft a layout parameter with far_copies=0 and the improved far set layout flag, then invoke the array creation or reshape ioctl. The resulting divide-by-zero triggers a kernel fault. The impact is denial of service against the storage subsystem and, depending on context, the entire host. No remote attack vector has been documented in the available references.

No verified public exploit code is available for CVE-2026-46161. Technical details for the fix are available in the upstream kernel commits, including kernel.org commit 4af2e558e6fd and kernel.org commit 9d8e03b9a2b1.

Detection Methods for CVE-2026-46161

Indicators of Compromise

Kernel oops or panic messages referencing setup_geo, raid10, or divide error in dmesg and /var/log/kern.log.
Unexpected failures during mdadm --create or mdadm --grow operations targeting RAID10 arrays.
Sudden unavailability of md-backed block devices following administrative RAID changes.

Detection Strategies

Monitor kernel ring buffer output for divide_error traces with raid10 frames on the stack.
Audit invocations of mdadm and direct ioctl calls against /dev/md* devices for non-standard layout values.
Inventory running kernels against the patched stable releases referenced in the upstream commits.

Monitoring Recommendations

Forward kern.log and journald kernel events to a centralized logging or SIEM platform and alert on kernel oops signatures.
Track privileged process execution involving mdadm, losetup, and md-related ioctls on storage hosts.
Correlate host reboots and storage subsystem failures with recent RAID configuration changes.

How to Mitigate CVE-2026-46161

Immediate Actions Required

Apply the upstream stable kernel update containing the setup_geo() validation fix and reboot affected systems.
Restrict CAP_SYS_ADMIN and direct access to /dev/md* and md ioctls to a minimal set of administrative accounts.
Audit existing RAID10 arrays and pending configuration scripts for layout values that set far_copies to zero.

Patch Information

The fix is committed to the upstream Linux stable tree across multiple branches. Reference commits include 4af2e558e6fd, 913d556e4bd1, 9aa6d860b093, 9d8e03b9a2b1, and f9ddb621b232. Consume the fix through the kernel updates published by your Linux distribution.

Workarounds

Avoid creating or reshaping RAID10 arrays on unpatched hosts until the kernel update is deployed.
Limit administrative shell access on storage nodes and require change control for any mdadm invocation.
Where feasible, deny module loading of raid10 on systems that do not require it using modprobe blacklists.

bash

# Verify running kernel and confirm patched build identifier
uname -r

# Inspect existing RAID10 layout values for anomalous configurations
mdadm --detail /dev/md0 | grep -i layout

# Optional: prevent raid10 module load on hosts that do not need it
echo 'install raid10 /bin/false' | sudo tee /etc/modprobe.d/disable-raid10.conf