In the Linux kernel’s RAID implementation, a flaw in the read error recovery path allowed raid1d and raid10d drivers to resubmit a bio that held an active reference while the array was suspended. The code attempted to acquire a second reference by calling percpu_ref_tryget_live(), which could fail or block, leading to a deadlock that freezes the array and stalls system I/O. The consequence is that a service or application relying on the affected array can become unresponsive, effectively denying availability, with the possibility of a system‑wide hang if the array is critical.

The vulnerability affects Linux kernel devices using the md RAID drivers, specifically the raid1 and raid10 device types in array configurations such as raid1d and raid10d. No specific kernel version numbers are listed, so all releases prior to the fix are potentially vulnerable.

The vulnerability carries a moderate severity rating with a CVSS score of 5.5. The EPSS score is below 1%, indicating a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires a privileged user or an attacker who can trigger a read error on a suspended RAID array; with no publicly available exploit, the most likely attack scenario involves local or privileged access to provoke the error recovery path. Without an attacker–controlled read error, the condition may not be reproducible. The fix in the upstream kernel replaces percpu_ref_tryget_live() with percpu_ref_get(), eliminating the reference contention and preventing the deadlock.