In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set array_frozen in raid1_takeover() raid1_takeover() sets conf->array_frozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once _wait_barrier() sees it stuck at 1. This used to be harmless: level_store() called mddev_resume() right after pers->run(), which called raid1_quiesce(mddev, 0) and cleared array_frozen back to 0 regardless of what raid1_takeover() set. Commit b39f35ebe86d ("md: don't quiesce in mddev_suspend()") removed that quiesce(mddev, 0) call, so the pre-set now sticks. setup_conf() already zero-initializes the new r1conf via kzalloc, so just don't set array_frozen here. Same class of bug as commit 892da88d1cd9 ("md/raid10: fix a 'conf->barrier' leakage in raid10_takeover()"), also triggered by b39f35ebe86d.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set array_frozen in
    raid1_takeover() raid1_takeover() sets conf->array_frozen = 1 on the newly-allocated r1conf and nothing
    ever clears it, so every I/O to the array stalls permanently once _wait_barrier() sees it stuck at 1. This
    used to be harmless: level_store() called mddev_resume() right after pers->run(), which called
    raid1_quiesce(mddev, 0) and cleared array_frozen back to 0 regardless of what raid1_takeover() set. Commit
    b39f35ebe86d ("md: don't quiesce in mddev_suspend()") removed that quiesce(mddev, 0) call, so the pre-set
    now sticks. setup_conf() already zero-initializes the new r1conf via kzalloc, so just don't set
    array_frozen here. Same class of bug as commit 892da88d1cd9 ("md/raid10: fix a 'conf->barrier' leakage in
    raid10_takeover()"), also triggered by b39f35ebe86d. (CVE-2026-90275)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - md/raid1: don't set array_frozen in raid1_takeover() raid1_takeover() sets conf->array_frozen = 1 on the     newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once
    _wait_barrier() sees it stuck at 1. This used to be harmless: level_store() called mddev_resume() right     after pers->run(), which called raid1_quiesce(mddev, 0) and cleared array_frozen back to 0 regardless of     what raid1_takeover() set. Commit b39f35ebe86d (md: don't quiesce in mddev_suspend()) removed that     quiesce(mddev, 0) call, so the pre-set now sticks. setup_conf() already zero-initializes the new r1conf     via kzalloc, so just don't set array_frozen here. Same class of bug as commit 892da88d1cd9 (md/raid10:
    fix a 'conf->barrier' leakage in raid10_takeover()), also triggered by b39f35ebe86d. (CVE-2026-90275)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364137	Oracle Linux 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
468245	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7	Tenable Cloud Security	Google COS Security Checks	Local	high
468245	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
347664	Linux Distros Unpatched Vulnerability : CVE-2026-90275	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-90275

high

Tenable Plugins

high

high

high

high

high

medium