GHSA-P657-P2PF-57VF
Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-17 18:32In the Linux kernel, the following vulnerability has been resolved:
md: scope memalloc_noio to allocation critical sections
Storing a memalloc_noio_save() token in mddev->noio_flags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter PF_MEMALLOC_NOIO, return to userspace still in that scope, and later task B can restore A's saved token.
Avoid tying the token lifetime to mddev. Keep mddev_suspend() and mddev_resume() only responsible for array suspension, and enter PF_MEMALLOC_NOIO only in the MD paths that allocate memory after the array has been suspended. Restore the token before resuming the array.
A reproducer repeatedly writes suspend_lo and suspend_hi from concurrent workers and checks each worker's /proc/self/stat flags before and after the sysfs write.
{
"affected": [],
"aliases": [
"CVE-2026-90389"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:38Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: scope memalloc_noio to allocation critical sections\n\nStoring a memalloc_noio_save() token in mddev-\u003enoio_flags lets one task\nsave the token and another task restore it. With concurrent suspend sysfs\nwrites, task A can enter PF_MEMALLOC_NOIO, return to userspace still in\nthat scope, and later task B can restore A\u0027s saved token.\n\nAvoid tying the token lifetime to mddev. Keep mddev_suspend() and\nmddev_resume() only responsible for array suspension, and enter\nPF_MEMALLOC_NOIO only in the MD paths that allocate memory after the array\nhas been suspended. Restore the token before resuming the array.\n\nA reproducer repeatedly writes suspend_lo and suspend_hi from concurrent\nworkers and checks each worker\u0027s /proc/self/stat flags before and after the\nsysfs write.",
"id": "GHSA-p657-p2pf-57vf",
"modified": "2026-09-17T18:32:03Z",
"published": "2026-09-17T18:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90389"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/28fdea874f68cac6c36651b1fc7272fd2199c48d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/72ebfdf507ede7d7f2b7ca0a5634811a0e4bf045"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a58923756b0f8e71032070c23ae0b167e46731da"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bace2010dd7ac07bc980575afb135c406730a7fe"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.