---
id: CVE-2026-89558
title: 'md/raid10: fix still_degraded being inverted in raid10_sync_request()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/raid10: fix still_degraded being inverted in raid10_sync_request()

  Commit fe6a19d40ceb ("md/md-bitmap: merge md_bitmap_start_sync() into
  bitmap_operations") convert…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-480
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fe6a19d40ceb44281905485f56dda715e3214e0e <
    9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4
  - >-
    Linux >= fe6a19d40ceb44281905485f56dda715e3214e0e <
    0efabe6229dc683dbf6eeebd0f9fddc7971ed420
  - >-
    Linux >= fe6a19d40ceb44281905485f56dda715e3214e0e <
    00449d752bee9c8787f42ea1bf533a9fb17f9b6b
  - >-
    Linux >= fe6a19d40ceb44281905485f56dda715e3214e0e <
    47f1441b281decde6954a2fa82b4131637d685ac
  - Linux 6.12
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:48:51.700Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89558'
references:
  - url: 'https://git.kernel.org/stable/c/9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4'
  - url: 'https://git.kernel.org/stable/c/0efabe6229dc683dbf6eeebd0f9fddc7971ed420'
  - url: 'https://git.kernel.org/stable/c/00449d752bee9c8787f42ea1bf533a9fb17f9b6b'
  - url: 'https://git.kernel.org/stable/c/47f1441b281decde6954a2fa82b4131637d685ac'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89558.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89558'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532221'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89558'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89558'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89558.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00635
epssPercentile: 0.50214
scores:
  cna: 9.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.474Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix still_degraded being inverted in raid10_sync_request()

Commit fe6a19d40ceb ("md/md-bitmap: merge md_bitmap_start_sync() into
bitmap_operations") converted still_degraded from int to bool, but
inverted the assignment in the loop that checks whether the array will
still be degraded after the current device is recovered:
"still_degraded = 1" became "still_degraded = false".

As a result, recovering a device while another mirror is still missing
calls md_bitmap_start_sync() with degraded == false, which clears bitmap
bits that the still-missing device needs.  When that device is re-added,
its bitmap-based recovery finds the bits already cleared and skips every
region written while the array was degraded, so it is marked In_sync
while holding stale data: silent corruption.

Reproducer (raid10 near=2, 4 disks, internal bitmap):
 - fail and remove one disk of each mirror pair
 - write to the degraded array
 - re-add both disks and let recovery finish
 - "check" reports mismatch_cnt=262272 after 256 MiB of degraded
   writes and file contents differ; the second disk's "recovery"
   completes in milliseconds because everything is skipped

The same conversion in raid1 got it right (still_degraded = true).
Restore the correct value.

## Affected

- `Linux >= fe6a19d40ceb44281905485f56dda715e3214e0e < 9bb8da6ecb330a5b1ac9b96f1e55f134a7aef1d4`
- `Linux >= fe6a19d40ceb44281905485f56dda715e3214e0e < 0efabe6229dc683dbf6eeebd0f9fddc7971ed420`
- `Linux >= fe6a19d40ceb44281905485f56dda715e3214e0e < 00449d752bee9c8787f42ea1bf533a9fb17f9b6b`
- `Linux >= fe6a19d40ceb44281905485f56dda715e3214e0e < 47f1441b281decde6954a2fa82b4131637d685ac`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89558.json)