CVE-2026-90385

A flaw was found in the Linux kernel. When a new storage device is added to an existing RAID1 array with a specific serialization policy enabled, a critical internal object is not properly initialized. This oversight can lead to a system crash, resulting in a Denial of Service (DoS) for the affected system.

This vulnerability is rated as Low impact because exploitation requires administrative privileges to add block devices to a software RAID array and depends on a non-default array configuration. Under default Red Hat Enterprise Linux deployments, RAID1 arrays do not enable request serialization. If an administrator attaches a member device to an array operating under this non-standard policy, uninitialized internal tracking structures lead to a kernel panic and local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.