CVE-2026-90401

CVE-2026-90401

High · published September 17, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

md: remove REQ_NOWAIT support from raid1/10/456

REQ_NOWAIT support in md personalities that can block internally is

fundamentally incomplete. While reads can avoid some blocking paths,

write requests can still encounter cases where one mirror succeeds while

another returns -EAGAIN. At that point md cannot distinguish queue

pressure from a real device failure, so it can neither record a bad

block nor safely retry the write without REQ_NOWAIT, leaving mirrors

with divergent data.

Rather than continue advertising REQ_NOWAIT support for personalities

that cannot implement it correctly, remove it from raid1, raid10 and

raid456. Keep REQ_NOWAIT for linear and raid0, which only remap bios to

their underlying devices; stacked limits will still clear the feature if

any component device lacks REQ_NOWAIT support.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00169 · 6.0th percentile
Published
2026-09-17T21:17Z
References (3)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:09Z
    md: remove REQ_NOWAIT support from raid1/10/456
    cvelistv5