CVE-2026-43271 - Vulnerability Details

- md-cluster: fix NULL pointer dereference in process_metadata_update

Description

In the Linux kernel, the following vulnerability has been resolved:

md-cluster: fix NULL pointer dereference in process_metadata_update

The function process_metadata_update() blindly dereferences the 'thread'
pointer (acquired via rcu_dereference_protected) within the wait_event()
macro.

While the code comment states "daemon thread must exist", there is a valid
race condition window during the MD array startup sequence (md_run):

1. bitmap_load() is called, which invokes md_cluster_ops->join().
2. join() starts the "cluster_recv" thread (recv_daemon).
3. At this point, recv_daemon is active and processing messages.
4. However, mddev->thread (the main MD thread) is not initialized until
later in md_run().

If a METADATA_UPDATED message is received from a remote node during this
specific window, process_metadata_update() will be called while
mddev->thread is still NULL, leading to a kernel panic.

To fix this, we must validate the 'thread' pointer. If it is NULL, we
release the held lock (no_new_dev_lockres) and return early, safely
ignoring the update request as the array is not yet fully ready to
process it.

Published: 2026-05-06

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability in the Linux kernel’s md-cluster subsystem causes a NULL pointer dereference when processing a METADATA_UPDATED message during a race condition in the array startup sequence. The dereference occurs in process_metadata_update() while the MD device’s main thread is still uninitialized, leading to a kernel panic and a system crash. This flaw does not provide privilege escalation or data exposure; its primary effect is instability and denial of service.

Affected Systems

The flaw resides in the Linux kernel; all kernels that include the md-cluster implementation before the patch are affected. Specific affected versions are not listed, so any kernel revision that has not incorporated the commit that validates the thread pointer should be considered vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates medium severity for this Linux kernel bug, yet the vulnerability carries a high impact because a kernel panic can occur. Exploitability requires an attacker to deliver a METADATA_UPDATED message during a narrow race window, which may limit practical attacks. EPSS score of <1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. Nevertheless, the potential for denial of service warrants prompt attention.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0ba959774e93911caff596de6391f085fb640ac4`	affected	< a61c1bc84c4a0f1e7c2fe55b0f43d7d94af4adf1
`0ba959774e93911caff596de6391f085fb640ac4`	affected	< dec123825c1ed74d98fd5fc7571a851dea4f46ff
`0ba959774e93911caff596de6391f085fb640ac4`	affected	< 721599e837d3f4c0e6cc14da059612c017b6d3ec
`0ba959774e93911caff596de6391f085fb640ac4`	affected	< dceb5a843910004cb118148e267036104fc3ee43
`0ba959774e93911caff596de6391f085fb640ac4`	affected	< f150e753cb8dd756085f46e86f2c35ce472e0a3c

Linux

affected

Version	Status	Constraints
`4.12`	affected	—
`0`	unaffected	< 4.12
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.16`	unaffected	≤ 6.18.*
`6.19.6`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a61c1bc84c4a0f1e7c2fe55b0f43d7d94af4adf1)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,dec123825c1ed74d98fd5fc7571a851dea4f46ff)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,721599e837d3f4c0e6cc14da059612c017b6d3ec)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,dceb5a843910004cb118148e267036104fc3ee43)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f150e753cb8dd756085f46e86f2c35ce472e0a3c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.6.128,6.6.*]`	unaffected	semver	—
`[6.12.75,6.12.*]`	unaffected	semver	—
`[6.18.16,6.18.*]`	unaffected	semver	—
`[6.19.6,6.19.*]`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the md-cluster NULL pointer dereference fix, such as the commit that validates the thread pointer in process_metadata_update().
If an immediate kernel upgrade is not possible, limit exposure by ensuring that MD cluster messages are only processed after the MD device thread is fully initialized; this may involve tuning cluster startup scripts or reordering initialization steps to avoid the race window.
As a temporary measure, use firewall or network segmentation to restrict incoming METADATA_UPDATED control traffic to trusted nodes, thereby reducing the chance that a malicious or misconfigured node can trigger the fault.

Generated by OpenCVE AI on May 8, 2026 at 21:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/721599e837d3f4c0e6cc14da059612c017b6d3ec
https://git.kernel.org/stable/c/a61c1bc84c4a0f1e7c2fe55b0f43d7d94af4adf1
https://git.kernel.org/stable/c/dceb5a843910004cb118148e267036104fc3ee43
https://git.kernel.org/stable/c/dec123825c1ed74d98fd5fc7571a851dea4f46ff
https://git.kernel.org/stable/c/f150e753cb8dd756085f46e86f2c35ce472e0a3c
https://lore.kernel.org/linux-cve-announce/2026050610-CVE-2026-43271-0404@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43271
https://www.cve.org/CVERecord?id=CVE-2026-43271

History

Fri, 08 May 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Thu, 07 May 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-476

Thu, 07 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026050610-CVE-2026-43271-0404@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43271 https://www.cve.org/CVERecord?id=CVE-2026-43271
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 06 May 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-476

Wed, 06 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: md-cluster: fix NULL pointer dereference in process_metadata_update The function process_metadata_update() blindly dereferences the 'thread' pointer (acquired via rcu_dereference_protected) within the wait_event() macro. While the code comment states "daemon thread must exist", there is a valid race condition window during the MD array startup sequence (md_run): 1. bitmap_load() is called, which invokes md_cluster_ops->join(). 2. join() starts the "cluster_recv" thread (recv_daemon). 3. At this point, recv_daemon is active and processing messages. 4. However, mddev->thread (the main MD thread) is not initialized until later in md_run(). If a METADATA_UPDATED message is received from a remote node during this specific window, process_metadata_update() will be called while mddev->thread is still NULL, leading to a kernel panic. To fix this, we must validate the 'thread' pointer. If it is NULL, we release the held lock (no_new_dev_lockres) and return early, safely ignoring the update request as the array is not yet fully ready to process it.
Title		md-cluster: fix NULL pointer dereference in process_metadata_update
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/721599e837d3f4c0e6cc14da059612c017b6d3ec https://git.kernel.org/stable/c/a61c1bc84c4a0f1e7c2fe55b0f43d7d94af4adf1 https://git.kernel.org/stable/c/dceb5a843910004cb118148e267036104fc3ee43 https://git.kernel.org/stable/c/dec123825c1ed74d98fd5fc7571a851dea4f46ff https://git.kernel.org/stable/c/f150e753cb8dd756085f46e86f2c35ce472e0a3c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-06T11:28:55.507Z

Updated: 2026-05-11T22:21:19.841Z

Reserved: 2026-05-01T14:12:55.998Z

Link: CVE-2026-43271

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-06T12:16:48.313

Modified: 2026-05-08T20:00:00.693

Link: CVE-2026-43271

Redhat

Severity : Moderate

Publid Date: 2026-05-06T00:00:00Z

Links: CVE-2026-43271 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-08T21:45:19Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object