CVE-2026-90279

A flaw was found in the Linux kernel's md/raid5 component. Incorrect rounding of bitmap stripes during sector division in the raid5_bitmap_sector_map() function can lead to an incorrect mapping of array ranges to component sectors. This issue can result in data corruption or unintended data access within a RAID5 array under specific configurations, such as a one-sector write operation on an array where the full RAID5 stripe width is not a power of two.

A moderate severity flaw was found in the Linux kernel's md/raid5 driver. The raid5_bitmap_sector_map() function aligned array sector ranges to full RAID5 stripe widths using mask-based round_down()/round_up() arithmetic before converting them to component sectors. Because the full stripe width, computed as the chunk size multiplied by the number of data disks, is not always a power of two, this rounding is incorrect on such geometries and the wrong component sector range can be recorded in the RAID5 write-intent bitmap for write operations (for example, a one-sector write on an array whose full-stripe width is 3072 sectors). Triggering this requires local access with write privileges to an already-configured RAID5 array whose full stripe width is not a power of two, and the consequence can be data corruption or unintended data access within the array, affecting the correctness of subsequent recovery or rebuild operations. Red Hat assessed the impact as Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The vulnerable raid5 bitmap sector-mapping code is present only in later kernel streams. Red Hat Enterprise Linux 7, the RHEL 8.4, 8.6, and 8.8 streams, the RHEL 9.2, 9.4, and 9.6 streams, the RHEL 10.0 stream, and OpenShift Container Platform 4.12 through 4.21 are not affected because the vulnerable code is not present there. The kernel package (and the kernel-rt variant in RHEL 8.10) in Red Hat Enterprise Linux 8.10, the RHEL 9.8, 9.9, and 9.10 streams, and the RHEL 10.2, 10.3, and 10.4 streams, as well as Red Hat In-Vehicle OS 2 and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 via RHEL CoreOS 9, are affected, and the fix is currently deferred. Because the flaw is rated Moderate and is reachable only through local write access to a RAID5 array with a specific geometry, an immediate update is not planned; the residual risk until a fix ships is that writes on affected arrays may track incorrect bitmap component ranges, which can compromise data integrity and recovery correctness on those arrays.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.