CVE-2026-89558: Linux Kernel RAID10 Privilege Escalation

CVE-2026-89558 Overview

CVE-2026-89558 is a logic inversion flaw in the Linux kernel md/raid10 driver that causes silent data corruption during recovery of degraded RAID10 arrays. The regression was introduced by commit fe6a19d40ceb ("md/md-bitmap: merge md_bitmap_start_sync() into bitmap_operations"), which converted the still_degraded variable from int to bool and inverted the assignment inside raid10_sync_request(). The original still_degraded = 1 became still_degraded = false, so the bitmap logic incorrectly treats a degraded array as fully healthy. Recovery then clears bitmap bits still needed by a missing mirror, and when that mirror is re-added the kernel marks it In_sync while holding stale data.

Critical Impact
Silent data corruption on RAID10 arrays after recovery of a degraded mirror pair, with no I/O error surfaced to userspace.

Affected Products

Linux kernel versions containing commit fe6a19d40ceb in the md/raid10 driver
Systems configured with RAID10 arrays using internal write-intent bitmaps
Distributions shipping the affected mainline and stable kernel branches prior to the fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89558 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89558

Vulnerability Analysis

The defect resides in raid10_sync_request() inside the Linux kernel software RAID (md) subsystem. During resynchronization, the function iterates over the mirror set to determine whether the array will remain degraded after the currently recovering device completes. That determination is passed to md_bitmap_start_sync() as the degraded argument, which controls whether bitmap bits corresponding to the sync region may be cleared. When a device is still missing, bitmap bits must be preserved so the missing device can later resync only the regions written during its absence.

Because still_degraded = false is assigned in the branch that should signal continued degradation, md_bitmap_start_sync() is invoked with degraded == false. The bitmap layer then clears bits for regions that the absent mirror still needs. When the absent device is re-added, its bitmap-driven recovery finds nothing to copy, completes in milliseconds, and the kernel promotes it to In_sync while it holds stale content.

Root Cause

The root cause is an inverted boolean assignment introduced during a type refactor from int to bool. The equivalent code path in raid1 correctly uses still_degraded = true, confirming the intended semantics. This is a logic error [CWE-697 / CWE-670] rather than a memory-safety bug, but it produces integrity loss on stored data.

Attack Vector

Exploitation does not require an attacker in the traditional sense. Any workload that writes to a degraded RAID10 near=2 array and then triggers recovery of both previously failed mirrors will silently corrupt data. The public reproducer uses a 4-disk RAID10 near=2 layout with an internal bitmap: fail and remove one disk from each mirror pair, write to the degraded array, then re-add both disks. After recovery, echo check > /sys/block/mdX/md/sync_action reports a large mismatch_cnt (262272 after 256 MiB of degraded writes) and file contents differ from what was written.

The vulnerability manifests entirely through legitimate storage operations. See the upstream fix commits referenced below for the exact code diff.

Detection Methods for CVE-2026-89558

Indicators of Compromise

Non-zero mismatch_cnt reported by /sys/block/mdX/md/mismatch_cnt after a check sync_action on a RAID10 array.
Recovery of a re-added RAID10 mirror completing in seconds or milliseconds despite significant writes having occurred while the array was degraded.
Application-level checksum failures, filesystem corruption, or dm-integrity mismatches on volumes backed by RAID10 arrays that experienced multi-disk failure and recovery.
Kernel log entries showing md/raid10 recovery finishing without transferring the expected data volume.

Detection Strategies

Run periodic check sync actions on all RAID10 arrays and alert on any non-zero mismatch_cnt value.
Correlate md recovery duration with the amount of data written during the degraded window; disproportionately fast recovery is a strong signal.
Verify kernel build metadata across the fleet and flag hosts running kernels that include commit fe6a19d40ceb but not the fix commits (00449d7, 0efabe6, 47f1441, 9bb8da6).

Monitoring Recommendations

Ingest /proc/mdstat, mdadm --detail, and kernel ring buffer output into centralized logging for continuous review of RAID state transitions.
Track SMART events and mirror failure counts so that any degraded window is time-bounded and auditable.
Alert on transitions from recovery to clean that occur faster than the array's expected throughput would allow.

How to Mitigate CVE-2026-89558

Immediate Actions Required

Inventory all systems running Linux kernels that contain commit fe6a19d40ceb and identify hosts using md RAID10 with internal bitmaps.
Update to a kernel that includes the upstream fix, then reboot to load the corrected raid10 module.
After patching, run echo check > /sys/block/mdX/md/sync_action on every RAID10 array and remediate any non-zero mismatch_cnt from backups.
Validate application-level data integrity on volumes that experienced degraded-mode writes prior to patching.

Patch Information

The fix restores still_degraded = true in raid10_sync_request(). Upstream commits are available in the stable tree: Kernel Git Commit 00449d7, Kernel Git Commit 0efabe6, Kernel Git Commit 47f1441, and Kernel Git Commit 9bb8da6. Apply the vendor-supplied kernel package from your distribution once it incorporates these commits.

Workarounds

Avoid operating RAID10 arrays in a state where more than one mirror is missing simultaneously; replace failed disks one at a time and allow full resync between replacements.
Where feasible, disable the internal write-intent bitmap on RAID10 arrays to force full resyncs, accepting the performance cost, until the kernel is patched.
Maintain verified, offline backups of data hosted on RAID10 arrays so that silent corruption can be detected and reverted.

bash

# Verify kernel version and check RAID10 arrays for silent corruption
uname -r
cat /proc/mdstat
for md in /sys/block/md*; do
  echo check > "$md/md/sync_action"
done
# After the check completes on each array:
cat /sys/block/mdX/md/mismatch_cnt