Impact
A defect in the Linux kernel’s device‑mapper subsystem caused the dm‑raid1 driver to treat the BLK_STS_NOTSUPP and BLK_STS_INVAL status codes as fatal, leading to premature failure of a storage leg. The applied patch changes the dm‑io interface so that it reports two separate bitmaps—error_bits for all other errors and unsup_bits for the two non‑retryable statuses—allowing dm‑raid1 to ignore the unsup_bits bitmap and avoid unnecessary leg shutdown. As a result, the vulnerability can cause service interruption when unaligned bio vectors are issued to dm‑raid1, as the driver would previously abort the leg erroneously.
Affected Systems
The affected systems are Linux kernels that include the dm‑raid1 component of the device‑mapper framework. Prior to the inclusion of commit 62dc37a819a5, any distribution running an older kernel that uses dm‑raid1 with unaligned bio vectors is susceptible. The specific kernel version range is not enumerated; lacking the patch, the vulnerability remains present in all older kernel releases that employ dm‑raid1.
Risk and Exploitability
The technical risk metric is limited to reliability impact; no remote exploitation path is documented. Given the EPSS score of less than 1%, exploitation likelihood is very low. The vulnerability is not listed in the CISA KEV catalog, further indicating a lack of known attacks. The flaw involves improper error handling, which would likely require local privileged execution to trigger the unstable error path. The CVSS score is not supplied, implying that the severity assessment in security metrics is low to moderate, but the potential for service disruption warrants timely remediation.
OpenCVE Enrichment