https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 10:38:20 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89558 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>md/raid10: fix still_degraded being inverted in raid10_sync_request()</p> <p>Commit fe6a19d40ceb (&#34;md/md-bitmap: merge md_bitmap_start_sync() into bitmap_operations&#34;) converted still_degraded from int to bool, but inverted the assignment in the loop that checks whether the array will still be degraded after the current device is recovered: &#34;still_degraded = 1&#34; became &#34;still_degraded = false&#34;.</p> <p>As a result, recovering a device while another mirror is still missing calls md_bitmap_start_sync() with degraded == false, which clears bitmap bits that the still-missing device needs. When that device is re-added, its bitmap-based recovery finds the bits already cleared and skips every region written while the array was degraded, so it is marked In_sync while holding stale data: silent corruption.</p> <p>Reproducer (raid10 near=2, 4 disks, internal bitmap): - fail and remove one disk of each mirror pair - write to the degraded array - re-add both disks and let recovery finish - &#34;check&#34; reports mismatch_cnt=262272 after 256 MiB of degraded writes and file contents differ; the second disk&#39;s &#34;recovery&#34; completes in milliseconds because everything is skipped</p> <p>The same conversion in raid1 got it right (still_degraded = true). Restore the correct value.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>md/raid10: fix still_degraded being inverted in raid10_sync_request()</p> <p>Commit fe6a19d40ceb (&#34;md/md-bitmap: merge md_bitmap_start_sync() into bitmap_operations&#34;) converted still_degraded from int to bool, but inverted the assignment in the loop that checks whether the array will still be degraded after the current device is recovered: &#34;still_degraded = 1&#34; became &#34;still_degraded = false&#34;.</p> <p>As a result, recovering a device while another mirror is still missing calls md_bitmap_start_sync() with degraded == false, which clears bitmap bits that the still-missing device needs. When that device is re-added, its bitmap-based recovery finds the bits already cleared and skips every region written while the array was degraded, so it is marked In_sync while holding stale data: silent corruption.</p> <p>Reproducer (raid10 near=2, 4 disks, internal bitmap): - fail and remove one disk of each mirror pair - write to the degraded array - re-add both disks and let recovery finish - &#34;check&#34; reports mismatch_cnt=262272 after 256 MiB of degraded writes and file contents differ; the second disk&#39;s &#34;recovery&#34; completes in milliseconds because everything is skipped</p> <p>The same conversion in raid1 got it right (still_degraded = true). Restore the correct value.</p> https://vulnerability.circl.lu/vuln/cve-2026-89558