{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89558", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.724Z", "datePublished": "2026-09-11T19:44:30.588Z", "dateUpdated": "2026-09-11T19:44:30.588Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:44:30.588Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix still_degraded being inverted in raid10_sync_request()\n\nCommit fe6a19d40ceb (\"md/md-bitmap: merge md_bitmap_start_sync() into\nbitmap_operations\") converted still_degraded from int to bool, but\ninverted the assignment in the loop that checks whether the array will\nstill be degraded after the current device is recovered:\n\"still_degraded = 1\" became \"still_degraded = false\".\n\nAs a result, recovering a device while another mirror is still missing\ncalls md_bitmap_start_sync() with degraded == false, which clears bitmap\nbits that the still-missing device needs. When that device is re-added,\nits bitmap-based recovery finds the bits already cleared and skips every\nregion written while the array was degraded, so it is marked In_sync\nwhile holding stale data: silent corruption.\n\nReproducer (raid10 near=2, 4 disks, internal bitmap):\n - fail and remove one disk of each mirror pair\n - write to the degraded array\n - re-add both disks and let recovery finish\n - \"check\" reports mismatch_cnt=262272 after 256 MiB of degraded\n writes and file contents differ; the second disk's \"recovery\"\n completes in milliseconds because everything is skipped\n\nThe same conversion in raid1 got it right (still_degraded = true).\nRestore the correct value."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/raid10.c"], "versions": [{"version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4", "status": "affected", "versionType": "git"}, {"version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "0efabe6229dc683dbf6eeebd0f9fddc7971ed420", "status": "affected", "versionType": "git"}, {"version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "00449d752bee9c8787f42ea1bf533a9fb17f9b6b", "status": "affected", "versionType": "git"}, {"version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "lessThan": "47f1441b281decde6954a2fa82b4131637d685ac", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/raid10.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4"}, {"url": "https://git.kernel.org/stable/c/0efabe6229dc683dbf6eeebd0f9fddc7971ed420"}, {"url": "https://git.kernel.org/stable/c/00449d752bee9c8787f42ea1bf533a9fb17f9b6b"}, {"url": "https://git.kernel.org/stable/c/47f1441b281decde6954a2fa82b4131637d685ac"}], "title": "md/raid10: fix still_degraded being inverted in raid10_sync_request()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/md/raid10.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4", "status": "affected", "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "versionType": "git"}, {"lessThan": "0efabe6229dc683dbf6eeebd0f9fddc7971ed420", "status": "affected", "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "versionType": "git"}, {"lessThan": "00449d752bee9c8787f42ea1bf533a9fb17f9b6b", "status": "affected", "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "versionType": "git"}, {"lessThan": "47f1441b281decde6954a2fa82b4131637d685ac", "status": "affected", "version": "fe6a19d40ceb44281905485f56dda715e3214e0e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/md/raid10.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix still_degraded being inverted in raid10_sync_request()\n\nCommit fe6a19d40ceb (\"md/md-bitmap: merge md_bitmap_start_sync() into\nbitmap_operations\") converted still_degraded from int to bool, but\ninverted the assignment in the loop that checks whether the array will\nstill be degraded after the current device is recovered:\n\"still_degraded = 1\" became \"still_degraded = false\".\n\nAs a result, recovering a device while another mirror is still missing\ncalls md_bitmap_start_sync() with degraded == false, which clears bitmap\nbits that the still-missing device needs. When that device is re-added,\nits bitmap-based recovery finds the bits already cleared and skips every\nregion written while the array was degraded, so it is marked In_sync\nwhile holding stale data: silent corruption.\n\nReproducer (raid10 near=2, 4 disks, internal bitmap):\n - fail and remove one disk of each mirror pair\n - write to the degraded array\n - re-add both disks and let recovery finish\n - \"check\" reports mismatch_cnt=262272 after 256 MiB of degraded\n writes and file contents differ; the second disk's \"recovery\"\n completes in milliseconds because everything is skipped\n\nThe same conversion in raid1 got it right (still_degraded = true).\nRestore the correct value."}], "id": "CVE-2026-89558", "lastModified": "2026-09-11T20:19:39.540", "metrics": {}, "published": "2026-09-11T20:19:39.540", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/00449d752bee9c8787f42ea1bf533a9fb17f9b6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0efabe6229dc683dbf6eeebd0f9fddc7971ed420"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47f1441b281decde6954a2fa82b4131637d685ac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel md/raid10: Silent data corruption due to inverted degraded state during array recovery", "id": "2532221", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532221"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-480", "details": ["A flaw was found in the Linux kernel's md/raid10 (RAID10) driver. This vulnerability occurs when a RAID10 array is in a degraded state and a device is being recovered while another mirror is still missing. Due to an inverted boolean value, the system incorrectly clears necessary bitmap bits, causing subsequent recovery operations to skip regions with stale data. This can lead to silent data corruption on the re-added device, impacting data integrity."], "name": "CVE-2026-89558", "public_date": "2026-09-11T19:44:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89558\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89558\nhttps://git.kernel.org/stable/c/00449d752bee9c8787f42ea1bf533a9fb17f9b6b\nhttps://git.kernel.org/stable/c/0efabe6229dc683dbf6eeebd0f9fddc7971ed420\nhttps://git.kernel.org/stable/c/47f1441b281decde6954a2fa82b4131637d685ac\nhttps://git.kernel.org/stable/c/9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4"], "threat_severity": "Moderate"}

{}