CVE-2026-90401

A flaw was found in the Linux kernel's Multiple Device (MD) RAID personalities, specifically raid1, raid10, and raid456. This vulnerability arises from incomplete support for the REQ_NOWAIT flag during write operations. When one mirror succeeds and another fails with an -EAGAIN error, the MD driver cannot correctly differentiate between temporary queue pressure and a permanent device failure. This can lead to divergent data across RAID mirrors, potentially resulting in data inconsistency or corruption.

REQ_NOWAIT support in md RAID1 RAID10 and RAID456 can produce mirror divergence because a nowait write may partially succeed on one member while another member returns EAGAIN. In that state md cannot safely classify the result as transient queue pressure or real device failure, so it may neither mark a bad block nor retry the write in a safe blocking mode. The realistic impact is local data integrity corruption on affected md arrays, with possible availability impact from inconsistent array contents or recovery behavior. For the CVSS the PR:L is used because a local user or process that can submit nowait writes to a filesystem or block path backed by the md array may be enough in some deployments, while direct raw array control may require higher privileges. The issue is not network reachable and there is no evidence of memory corruption or direct privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.