{"id":"CVE-2026-43309","title":"md raid: fix hang when stopping arrays with metadata through dm-raid","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd raid: fix hang when stopping arrays with metadata through dm-raid\n\nWhen using device-mapper's dm-raid target, stopping a RAID array can cause\nthe system to hang unde…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 0dd84b319352bb8ba64752d4e45396d8b13e6018 < 63054027d95200b04f3cf624faa7817e0555d56a","Linux >= 0dd84b319352bb8ba64752d4e45396d8b13e6018 < 24783dd06de870d646c25207bae186f78195f912","Linux >= 0dd84b319352bb8ba64752d4e45396d8b13e6018 < 338378dfffbdbb8d37a18f0a0c0358812671f91e","Linux >= 0dd84b319352bb8ba64752d4e45396d8b13e6018 < cefcb9297fbdb6d94b61787b4f8d84f55b741470","Linux 1678ca35b80a94d474fdc31e2497ce5d7ed52512","Linux 690b5c90fd2d81fd1d2b6110fa36783232f6dce2","Linux 8e7fb19f1a744fd34e982633ced756fee0498ef7","Linux a5a58fab556bfe618b4c9719eb85712d78c6cb10","Linux 661c01b2181d9413c799127f13143583b69f20fd","Linux f42a9819ba84bed2e609a4dff56af37063dcabdc","Linux >= 4.14.292 < 4.15","Linux >= 4.19.257 < 4.20","Linux >= 5.4.212 < 5.5","Linux >= 5.10.140 < 5.11","Linux >= 5.15.64 < 5.16","Linux >= 5.19.6 < 5.20","Linux 6.0"],"published":"2026-05-08","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:40:34.118Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43309","references":[{"url":"https://git.kernel.org/stable/c/63054027d95200b04f3cf624faa7817e0555d56a"},{"url":"https://git.kernel.org/stable/c/24783dd06de870d646c25207bae186f78195f912"},{"url":"https://git.kernel.org/stable/c/338378dfffbdbb8d37a18f0a0c0358812671f91e"},{"url":"https://git.kernel.org/stable/c/cefcb9297fbdb6d94b61787b4f8d84f55b741470"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.04832,"ingestedAt":"2026-10-21T12:48:53.643Z","slug":"CVE-2026-43309","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd raid: fix hang when stopping arrays with metadata through dm-raid\n\nWhen using device-mapper's dm-raid target, stopping a RAID array can cause\nthe system to hang under specific conditions.\n\nThis occurs when:\n\n- A dm-raid managed device tree is suspended from top to bottom\n   (the top-level RAID device is suspended first, followed by its\n    underlying metadata and data devices)\n\n- The top-level RAID device is then removed\n\nRemoving the top-level device triggers a hang in the following sequence:\nthe dm-raid destructor calls md_stop(), which tries to flush the\nwrite-intent bitmap by writing to the metadata sub-devices. However, these\ndevices are already suspended, making them unable to complete the write-intent\noperations and causing an indefinite block.\n\nFix:\n\n- Prevent bitmap flushing when md_stop() is called from dm-raid\ndestructor context\n  and avoid a quiescing/unquescing cycle which could also cause I/O\n\n- Still allow write-intent bitmap flushing when called from dm-raid\nsuspend context\n\nThis ensures that RAID array teardown can complete successfully even when the\nunderlying devices are in a suspended state.\n\nThis second patch uses md_is_rdwr() to distinguish between suspend and\ndestructor paths as elaborated on above.\n\n## Affected\n\n- `Linux >= 0dd84b319352bb8ba64752d4e45396d8b13e6018 < 63054027d95200b04f3cf624faa7817e0555d56a`\n- `Linux >= 0dd84b319352bb8ba64752d4e45396d8b13e6018 < 24783dd06de870d646c25207bae186f78195f912`\n- `Linux >= 0dd84b319352bb8ba64752d4e45396d8b13e6018 < 338378dfffbdbb8d37a18f0a0c0358812671f91e`\n- `Linux >= 0dd84b319352bb8ba64752d4e45396d8b13e6018 < cefcb9297fbdb6d94b61787b4f8d84f55b741470`\n- `Linux 1678ca35b80a94d474fdc31e2497ce5d7ed52512`\n- `Linux 690b5c90fd2d81fd1d2b6110fa36783232f6dce2`\n- `Linux 8e7fb19f1a744fd34e982633ced756fee0498ef7`\n- `Linux a5a58fab556bfe618b4c9719eb85712d78c6cb10`\n- `Linux 661c01b2181d9413c799127f13143583b69f20fd`\n- `Linux f42a9819ba84bed2e609a4dff56af37063dcabdc`\n- `Linux >= 4.14.292 < 4.15`\n- `Linux >= 4.19.257 < 4.20`\n- `Linux >= 5.4.212 < 5.5`\n- `Linux >= 5.10.140 < 5.11`\n- `Linux >= 5.15.64 < 5.16`\n- `Linux >= 5.19.6 < 5.20`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}