CVE-2026-90400

A flaw was found in the Linux kernel's Multiple Device (MD) driver. A race condition exists where the system may attempt to remove or replace RAID array devices while they are still actively being used for input/output operations. This can lead to a null pointer dereference, causing the system to crash and resulting in a Denial of Service (DoS).

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and precise timing during concurrent RAID spare reconfiguration and disk I/O, with the maximum blast radius limited to a system crash (denial of service). In typical enterprise environments, software RAID arrays only execute spare disk replacement or synchronization upon administrative intervention or underlying hardware failure events. Consequently, standard system operations are rarely exposed to this race condition, and unprivileged users cannot directly trigger array reconfigurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.