CVE-2026-53125 Overview
CVE-2026-53125 is a Linux kernel vulnerability in the multiple device (md) driver. The flaw causes a recursive locking deadlock when userspace writes clear to the array_state sysfs attribute of an md array. The defect originates in md_attr_store(), which drops the mddev reference before calling sysfs_unbreak_active_protection(). Under specific timing, the last kobject reference can be released from the active sysfs writer context, triggering kernfs removal recursion on kn->active. Lockdep reports the condition as possible recursive locking, and the kernel call path enters kernfs_drain() while the same node is still being unwound.
Critical Impact
A local user with permission to write to /sys/block/mdX/md/array_state can trigger a kernel deadlock during md array teardown, leading to denial of service on the affected host.
Affected Products
- Linux kernel (md / multiple device driver subsystem)
- Stable kernel branches addressed by commits 2aa72276, 62c44566, and 92ad0ec5
- Systems exposing md arrays through sysfs (/sys/block/mdX/md/array_state)
Discovery Timeline
- 2026-06-24 - CVE-2026-53125 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53125
Vulnerability Analysis
The vulnerability is a race condition and recursive locking defect [CWE-667] in the md driver's sysfs store handler. When userspace writes clear to array_state, md_attr_store() calls sysfs_break_active_protection() so the array can delete itself from within its own sysfs store method. The function then invokes do_md_stop(..., 0), which marks the mddev eligible for delayed deletion.
The ordering of cleanup steps is incorrect. md_attr_store() drops the mddev reference before calling sysfs_unbreak_active_protection(). After mddev_put() runs, the temporary kobject reference held by sysfs_break_active_protection() can become the last reference protecting the md kobject. When sysfs_unbreak_active_protection() then drops that reference, kobject teardown recurses into kernfs_remove_by_name_ns() and __kernfs_remove() while the current sysfs node is still being unwound.
The lockdep warning shows the same kn->active lock acquired twice in one task. The call chain runs kernfs_fop_write_iter → md_attr_store → kobject_put → __kobject_del → sysfs_remove_groups → kernfs_drain.
Root Cause
The root cause is incorrect lifetime ordering between the mddev reference and the sysfs active protection break. Restoring active protection must occur while the mddev is still held alive so the extra kobject reference is dropped safely, deferring md kobject deletion until after the sysfs write path returns.
Attack Vector
A local user or process with write access to the md sysfs attributes can reach the defective code path by activating an array and then writing clear to array_state. The reproducer in the upstream commit message activates an md0 linear array, waits briefly, and writes clear, which triggers the lockdep splat and recursive locking condition. No remote attack vector is associated with this defect.
No verified public proof-of-concept exploit code is available beyond the reproducer steps documented in the kernel commit. See the Git Kernel Commit 92ad0ec5 for the technical fix and reproducer.
Detection Methods for CVE-2026-53125
Indicators of Compromise
- Kernel log entries containing WARNING: possible recursive locking detected with kn->active referenced twice in the held-lock and acquire stacks.
- Call traces showing kernfs_drain → __kernfs_remove → kernfs_remove_by_name_ns → sysfs_remove_group → kobject_put → md_attr_store in the same task.
- Hung-task or soft-lockup reports referencing tasks blocked in md sysfs store paths after array_state writes.
Detection Strategies
- Monitor dmesg and /var/log/kern.log for lockdep splats that include both md_attr_store and sysfs_unbreak_active_protection frames.
- Audit process activity that writes to /sys/block/md*/md/array_state with the value clear, particularly from non-administrative contexts.
- Compare running kernel versions against vendor advisories that backport commits 2aa72276, 62c44566, and 92ad0ec5.
Monitoring Recommendations
- Forward kernel ring buffer events to a central logging pipeline and alert on recursive locking detected patterns.
- Track auditd PATH records for writes to md sysfs nodes to correlate user activity with kernel warnings.
- Inventory hosts running md/RAID volumes and tag them for priority patching once a fixed kernel is available.
How to Mitigate CVE-2026-53125
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 2aa72276, 62c44566, and 92ad0ec5 once they reach your distribution's stable update channel.
- Restrict write access to /sys/block/md*/md/array_state to administrative users only, in line with default permissions.
- Identify hosts using md/RAID arrays and prioritize them for the next kernel update window.
Patch Information
The fix reorders md_attr_store() so sysfs_unbreak_active_protection() is called before mddev_put(). This keeps the mddev alive while the temporary kobject reference is released, deferring kobject deletion until after the sysfs writer context returns. The corrected code is available in the kernel.org stable tree via Git Kernel Commit 2aa72276, Git Kernel Commit 62c44566, and Git Kernel Commit 92ad0ec5.
Workarounds
- Avoid writing clear to array_state; use inactive followed by array removal through mdadm --stop where supported.
- Ensure only root or privileged storage management tooling can modify md sysfs attributes, and remove any group write delegations.
- Where feasible, run lockdep-enabled test kernels in staging to confirm the patched code path no longer produces the recursive locking warning.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
