CVE-2026-53125

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> md: fix array_state=clear sysfs deadlock<br /> <br /> When "clear" is written to array_state, md_attr_store() breaks sysfs<br /> active protection so the array can delete itself from its own sysfs<br /> store method.<br /> <br /> However, md_attr_store() currently drops the mddev reference before<br /> calling sysfs_unbreak_active_protection(). Once do_md_stop(..., 0)<br /> has made the mddev eligible for delayed deletion, the temporary<br /> kobject reference taken by sysfs_break_active_protection() can become<br /> the last kobject reference protecting the md kobject.<br /> <br /> That allows sysfs_unbreak_active_protection() to drop the last<br /> kobject reference from the current sysfs writer context. kobject<br /> teardown then recurses into kernfs removal while the current sysfs<br /> node is still being unwound, and lockdep reports recursive locking on<br /> kn-&gt;active with kernfs_drain() in the call chain.<br /> <br /> Reproducer on an existing level:<br /> 1. Create an md0 linear array and activate it:<br /> mknod /dev/md0 b 9 0<br /> echo none &gt; /sys/block/md0/md/metadata_version<br /> echo linear &gt; /sys/block/md0/md/level<br /> echo 1 &gt; /sys/block/md0/md/raid_disks<br /> echo "$(cat /sys/class/block/sdb/dev)" &gt; /sys/block/md0/md/new_dev<br /> echo "$(($(cat /sys/class/block/sdb/size) / 2))" &gt; \<br /> /sys/block/md0/md/dev-sdb/size<br /> echo 0 &gt; /sys/block/md0/md/dev-sdb/slot<br /> echo active &gt; /sys/block/md0/md/array_state<br /> 2. Wait briefly for the array to settle, then clear it:<br /> sleep 2<br /> echo clear &gt; /sys/block/md0/md/array_state<br /> <br /> The warning looks like:<br /> <br /> WARNING: possible recursive locking detected<br /> bash/588 is trying to acquire lock:<br /> (kn-&gt;active#65) at __kernfs_remove+0x157/0x1d0<br /> but task is already holding lock:<br /> (kn-&gt;active#65) at sysfs_unbreak_active_protection+0x1f/0x40<br /> ...<br /> Call Trace:<br /> kernfs_drain<br /> __kernfs_remove<br /> kernfs_remove_by_name_ns<br /> sysfs_remove_group<br /> sysfs_remove_groups<br /> __kobject_del<br /> kobject_put<br /> md_attr_store<br /> kernfs_fop_write_iter<br /> vfs_write<br /> ksys_write<br /> <br /> Restore active protection before mddev_put() so the extra sysfs<br /> kobject reference is dropped while the mddev is still held alive. The<br /> actual md kobject deletion is then deferred until after the sysfs<br /> write path has fully returned.