{"id":"CVE-2026-89558","revision":"c1955d9c966c4dbfafd13a00a877ab6a","records":[{"revision":"c1955d9c966c4dbfafd13a00a877ab6a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89558","aliases":[],"title":"md/raid10: fix still_degraded being inverted in raid10_sync_request()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix still_degraded being inverted in raid10_sync_request()\n\nCommit fe6a19d40ceb (\"md/md-bitmap: merge md_bitmap_start_sync() into\nbitmap_operations\") converted still_degraded from int to bool, but\ninverted the assignment in the loop that checks whether the array will\nstill be degraded after the current device is recovered:\n\"still_degraded = 1\" became \"still_degraded = false\".\n\nAs a result, recovering a device while another mirror is still missing\ncalls md_bitmap_start_sync() with degraded == false, which clears bitmap\nbits that the still-missing device needs.  When that device is re-added,\nits bitmap-based recovery finds the bits already cleared and skips every\nregion written while the array was degraded, so it is marked In_sync\nwhile holding stale data: silent corruption.\n\nReproducer (raid10 near=2, 4 disks, internal bitmap):\n - fail and remove one disk of each mirror pair\n - write to the degraded array\n - re-add both disks and let recovery finish\n - \"check\" reports mismatch_cnt=262272 after 256 MiB of degraded\n   writes and file contents differ; the second disk's \"recovery\"\n   completes in milliseconds because everything is skipped\n\nThe same conversion in raid1 got it right (still_degraded = true).\nRestore the correct value.","state":0,"publishedAt":"2026-09-11T19:44:30.588+00:00","modifiedAt":"2026-10-19T08:48:51.7+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/raid10.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"fe6a19d40ceb44281905485f56dda715e3214e0e\",\n                            \"lessThan\": \"9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fe6a19d40ceb44281905485f56dda715e3214e0e\",\n                            \"lessThan\": \"0efabe6229dc683dbf6eeebd0f9fddc7971ed420\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fe6a19d40ceb44281905485f56dda715e3214e0e\",\n                            \"lessThan\": \"00449d752bee9c8787f42ea1bf533a9fb17f9b6b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fe6a19d40ceb44281905485f56dda715e3214e0e\",\n                            \"lessThan\": \"47f1441b281decde6954a2fa82b4131637d685ac\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/raid10.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4","https://git.kernel.org/stable/c/0efabe6229dc683dbf6eeebd0f9fddc7971ed420","https://git.kernel.org/stable/c/00449d752bee9c8787f42ea1bf533a9fb17f9b6b","https://git.kernel.org/stable/c/47f1441b281decde6954a2fa82b4131637d685ac"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89558","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89558","identifiers":["CVE-2026-89558"]},"retained":false,"historicalAffected":[]}],"coverage":[]}