CVE-2026-90277: md/md-llbitmap: prevent create failure bitmap UAF
In the Linux kernel, the following vulnerability has been resolved:
md/md-llbitmap: prevent create failure bitmap UAF
llbitmapcreate() publishes mddev->bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb() can initialize a new bitmap and flush it through helpers that use mddev->bitmap.
If llbitmapreadsb() fails, the old cleanup dropped bitmapinfo.mutex and freed llbitmap before clearing mddev->bitmap. Readers such as /proc/mdstat rely on bitmapinfo.mutex to keep the bitmap pointer stable while collecting bitmap stats, so they could observe the stale pointer after the failed create path released the mutex.
Clear mddev->bitmap while still holding bitmapinfo.mutex, then free the failed llbitmap after dropping the mutex. This makes mutex-protected readers see either a live bitmap or no bitmap.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Linux kernel systems using the md driver’s llbitmap functionality are relevant. The race involves readers such as /proc/mdstat accessing bitmap statistics while llbitmap creation fails.
What conditions are needed to trigger the use-after-free?
An llbitmap creation attempt must publish mddev->bitmap and then fail while reading the bitmap superblock. A concurrent mutex-protected reader must access bitmap information after the failed path releases bitmap_info.mutex but before the stale pointer is cleared.
How can I tell whether the fix is present?
The corrected behavior clears mddev->bitmap while bitmap_info.mutex is still held, and frees the failed llbitmap only after releasing that mutex. Check the applicable kernel source or stable commit history for this ordering in the llbitmap create-failure cleanup path.