CVE-2026-90389md: scope memalloc_noio to allocation critical sections
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: md: scope memalloc_noio to allocation critical sections Storing a memalloc_noio_save() token in mddev->noio_flags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter PF_MEMALLOC_NOIO, return to userspace still in that scope, and later task B can restore A's saved token. Avoid tying the token lifetime to mddev. Keep mddev_suspend() and mddev_resume() only responsible for array suspension, and enter PF_MEMALLOC_NOIO only in the MD paths that allocate memory after the array has been suspended. Restore the token before resuming the array. A reproducer repeatedly writes suspend_lo and suspend_hi from concurrent workers and checks each worker's /proc/self/stat flags before and after the sysfs write.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 78f57ef9d50a75326da73d352d7c27828495229a builds before 72ebfdf507ede7d7f2b7ca0a5634811a0e4bf045; 78f57ef9d50a75326da73d352d7c27828495229a builds before 28fdea874f68cac6c36651b1fc7272fd2199c48d; from 78f57ef9d50a75326da73d352d7c27828495229a before a58923756b0f8e71032070c23ae0b167e46731da; from 78f57ef9d50a75326da73d352d7c27828495229a before bace2010dd7ac07bc980575afb135c406730a7fe | CNA record |
References
- https://git.kernel.org/stable/c/72ebfdf507ede7d7f2b7ca0a5634811a0e4bf045
- https://git.kernel.org/stable/c/28fdea874f68cac6c36651b1fc7272fd2199c48d
- https://git.kernel.org/stable/c/a58923756b0f8e71032070c23ae0b167e46731da
- https://git.kernel.org/stable/c/bace2010dd7ac07bc980575afb135c406730a7fe
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.