CVE-2026-89558
A bug in the Linux kernel’s RAID10 implementation caused data corruption when a degraded array was recovered. The issue stemmed from an inverted flag that cleared bitmap bits needed for recovery, leading to silent data loss. The kernel has been patched to correct this logic.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux systems using the kernel’s RAID10 driver with an internal bitmap, particularly those that may experience disk failures and subsequent recovery.
Real-world impact
An attacker or accidental disk failure could result in silent corruption of files and data, with no immediate error indication. The corrupted data would be considered valid, potentially compromising data integrity and availability.
Why this severity
The CVSS score of 9.8 reflects that the flaw allows a network attacker to cause complete loss of confidentiality, integrity, and availability without authentication or user interaction, making it a critical vulnerability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes commit fe6a19d40ceb or later.
- 02Restart the system (or reload the kernel module) to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.