CVE-2026-90400

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the md module where md start sync() checks for spare configuration changes before acquiring the reconfig mutex. Because the rdev state can change before the mutex is acquired, the initial check may become stale, allowing md choose sync action() to remove or replace rdevs while normal I/O is still accessing them. This can lead to a NULL pointer dereference in the rdev dec pending() function when attempting to decrement the nr pending variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.