CVE-2024-26755: md: Don't suspend the array for interrupted reshape
In the Linux kernel, the following vulnerability has been resolved:
md: Don't suspend the array for interrupted reshape
md_start_sync() will suspend the array if there are spares that can be
added or removed from conf, however, if reshape is still in progress,
this won't happen at all or data will be corrupted(remove_and_add_spares
won't be called from md_choose_sync_action for reshape), hence there is
no need to suspend the array if reshape is not done yet.
Meanwhile, there is a potential deadlock for raid456:
1) reshape is interrupted;
2) set one of the disk WantReplacement, and add a new disk to the array,
however, recovery won't start until the reshape is finished;
3) then issue an IO across reshpae position, this IO will wait for
reshape to make progress;
4) continue to reshape, then md_start_sync() found there is a spare disk
that can be added to conf, mddev_suspend() is called;
Step 4 and step 3 is waiting for each other, deadlock triggered. Noted
this problem is found by code review, and it's not reporduced yet.
Fix this porblem by don't suspend the array for interrupted reshape,
this is safe because conf won't be changed until reshape is done.
Security readout for executives and security teams
Plain-English summary
This Linux kernel bug can deadlock certain software RAID arrays during an interrupted reshape, causing availability impact. The source describes possible data corruption avoidance logic and a deadlock found by code review, not reproduced in testing. Business urgency is highest for systems relying on Linux md RAID456 during disk replacement or reshape operations.
Executive priority
Treat as a targeted storage availability risk, not a broad internet emergency. Patch through normal kernel maintenance, but prioritize critical Linux storage systems where md RAID reshape or disk replacement is operationally likely.
Technical view
CVE-2024-26755 affects Linux md RAID handling when md_start_sync() suspends an array while reshape is unfinished and spare changes are pending. For raid456, IO crossing the reshape position can wait on reshape progress while reshape waits on mddev_suspend(), creating a deadlock. The fix avoids suspending during interrupted reshape because configuration changes wait until reshape completes.
Likely exposure
Exposure is limited to Linux systems using md software RAID, especially RAID4/5/6 arrays undergoing interrupted reshape plus replacement or spare-disk activity. General Linux hosts without md RAID reshape workflows are unlikely to be exposed based on the source description.
Exploitation context
No active exploitation is cited. The CVE is not listed as KEV, and the kernel description says the issue was found by code review and had not been reproduced. Practical exploitation details are not established in the supplied sources.
Researcher notes
The source identifies a raid456 deadlock sequence involving interrupted reshape, WantReplacement, a spare disk, IO across the reshape position, and mddev_suspend(). Evidence is strongest for code-level correctness; exploitability and reproducibility remain unclear from the supplied sources.
Mitigation direction
Upgrade to a kernel containing the referenced stable fixes.
Check your Linux distribution advisory for fixed kernel packages.
Avoid unnecessary md RAID reshape or replacement activity until patched.
Prioritize storage hosts using md RAID456 and recent affected kernels.
Validation and detection
Inventory Linux hosts using md software RAID arrays.
Identify kernel versions matching the CVE affected range.
Review whether RAID reshape or replacement operations recently occurred.
Confirm installed kernel includes the referenced stable commits.
Monitor storage hosts for md deadlock or stalled IO symptoms.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-26755 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.