CVE-2026-90389 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
md: scope memalloc_noio to allocation critical sections
Storing a memalloc_noio_save() token in mddev->noio_flags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter PF_MEMALLOC_NOIO, return to userspace still in that scope, and later task B can restore A's saved token.
Avoid tying the token lifetime to mddev. Keep mddev_suspend() and mddev_resume() only responsible for array suspension, and enter PF_MEMALLOC_NOIO only in the MD paths that allocate memory after the array has been suspended. Restore the token before resuming the array.
A reproducer repeatedly writes suspend_lo and suspend_hi from concurrent workers and checks each worker's /proc/self/stat flags before and after the sysfs write.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel RAID subsystem, specifically the md driver, contained a critical concurrency flaw related to memory allocation context management during device suspension operations. The vulnerability stemmed from an improper scoping of memalloc_noio tokens within the mddev structure. In this flawed implementation, the system stored a memalloc_noio_save token directly in the mddev->noio_flags field. This design choice created a race condition where the lifetime of the memory allocation context was incorrectly tied to the lifecycle of the device structure rather than the specific critical section requiring it. The core issue arises when multiple tasks interact with the sysfs interface for suspending and resuming RAID arrays concurrently, leading to state corruption that can compromise system stability and integrity during high-load or concurrent administrative operations.
The technical mechanism of this vulnerability involves a race condition between two distinct kernel threads operating on the same md device structure. Task A enters the PF_MEMALLOC_NOIO context by calling memalloc_noio_save and stores its token in the shared mddev->noio_flags field. If Task A returns to userspace or yields execution while still within this scope, it leaves the flag set but does not immediately restore the previous allocation context. Subsequently, if Task B initiates a suspend operation on the same device, it reads the stale token saved by Task A and attempts to restore that specific state. This results in Task B operating under an incorrect memory allocation constraint intended for Task A, or potentially leaving both tasks in an inconsistent state regarding their ability to allocate memory without triggering I/O operations. The PF_MEMALLOC_NOIO flag is designed to prevent blocking on disk I/O during critical kernel paths; misapplying this context can lead to deadlocks if the system expects non-blocking behavior but encounters unavoidable I/O, or it may mask underlying issues by suppressing necessary allocation failures that should have been reported.
The operational impact of this vulnerability extends beyond simple race conditions affecting administrative tasks. By allowing concurrent sysfs writes to corrupt memory allocation contexts, the flaw can lead to unpredictable kernel behavior during RAID array management. In severe cases, incorrect handling of memalloc_noio tokens can result in deadlocks where processes wait indefinitely for I/O completions that are blocked by the misconfigured context flags. This affects system availability and reliability, particularly in environments with frequent RAID configuration changes or automated maintenance scripts that interact with md devices concurrently. The vulnerability highlights a fundamental architectural weakness in how kernel subsystems manage per-task memory allocation contexts when shared data structures like mddev are involved across multiple execution paths without proper synchronization of the context lifecycle.
To mitigate this vulnerability, the Linux kernel developers implemented a structural refactoring of the suspend and resume logic within the md driver. The fix decouples the token lifetime from the md device structure itself. Instead of storing tokens in mddev->noio_flags, the updated code ensures that memalloc_noio contexts are entered only within specific MD paths where memory allocation occurs after the array has been successfully suspended. This approach confines the scope of PF_MEMALLOC_NOIO to the exact critical sections requiring it, ensuring that tasks do not retain these flags outside their intended operational window. The mddev_suspend and mddev_resume functions were revised to focus solely on array suspension mechanics without managing global memory allocation states for arbitrary concurrent users. Furthermore, tokens are now restored immediately before resuming the array, guaranteeing that no residual context persists across task boundaries or sysfs interactions.
This remediation aligns with best practices in kernel development regarding resource scoping and concurrency control. From a vulnerability classification perspective, this issue relates to CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, as the race condition arises from unsynchronized access to shared state affecting memory allocation behavior. It also touches upon CWE-459: Incomplete Cleanup, since previous implementations failed to properly restore or isolate allocation contexts when tasks exited their critical sections prematurely. The fix ensures that memory management operations remain isolated and deterministic, preventing side effects on unrelated kernel threads. System administrators should ensure they are running patched versions of the Linux kernel where these md driver changes have been integrated to maintain stability during concurrent RAID configuration activities.