GHSA-3W3Q-M725-W3PG
Vulnerability from github – Published: 2026-09-17 18:31 – Updated: 2026-09-17 18:31In the Linux kernel, the following vulnerability has been resolved:
md/raid5: round bitmap stripes with sector division
raid5_bitmap_sector_map() aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunk_sectors multiplied by the number of data disks, and it is not always a power of two.
Reproduce with a 4-disk RAID5, 1024-sector chunks, and three data disks. The full-stripe width is 3072 sectors. For a one-sector write at array sector 3072, correct rounding gives array range [3072, 6144), which maps to component range [1024, 2048). The old round_down()/round_up() logic instead gives [1024, 4096), which maps to [0, 1024).
Use sector_div() based arithmetic so the rounded range is aligned to the actual RAID5 stripe width.
The deterministic mapper test now reports the fixed component range as [1024, 2048), while the old mask-based range was [0, 1024).
{
"affected": [],
"aliases": [
"CVE-2026-90279"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:24Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: round bitmap stripes with sector division\n\nraid5_bitmap_sector_map() aligns the array range to full RAID5 stripe\nwidths before converting it to component sectors. That width is\nchunk_sectors multiplied by the number of data disks, and it is not\nalways a power of two.\n\nReproduce with a 4-disk RAID5, 1024-sector chunks, and three data disks.\nThe full-stripe width is 3072 sectors. For a one-sector write at array\nsector 3072, correct rounding gives array range [3072, 6144), which maps\nto component range [1024, 2048). The old round_down()/round_up() logic\ninstead gives [1024, 4096), which maps to [0, 1024).\n\nUse sector_div() based arithmetic so the rounded range is aligned to the\nactual RAID5 stripe width.\n\nThe deterministic mapper test now reports the fixed component range as\n[1024, 2048), while the old mask-based range was [0, 1024).",
"id": "GHSA-3w3q-m725-w3pg",
"modified": "2026-09-17T18:31:58Z",
"published": "2026-09-17T18:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90279"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/02c10581866d08822c6348e299881485fc546185"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/17ea021ae74987d6064c8195c4922fa025753892"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9d7490007707f90691911385365bd1d691d99225"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cab7d949b18b2f1cd625689dc16c5f81236bac93"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ccbdc483eb041eef809e9ff223d1ad63518a2c52"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.