CVE-2026-90277: md/md-llbitmap: prevent create failure bitmap UAF

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

md/md-llbitmap: prevent create failure bitmap UAF

llbitmapcreate() publishes mddev->bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb() can initialize a new bitmap and flush it through helpers that use mddev->bitmap.

If llbitmapreadsb() fails, the old cleanup dropped bitmapinfo.mutex and freed llbitmap before clearing mddev->bitmap. Readers such as /proc/mdstat rely on bitmapinfo.mutex to keep the bitmap pointer stable while collecting bitmap stats, so they could observe the stale pointer after the failed create path released the mutex.

Clear mddev->bitmap while still holding bitmapinfo.mutex, then free the failed llbitmap after dropping the mutex. This makes mutex-protected readers see either a live bitmap or no bitmap.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 17, 2026
CVE Published
via MITRE·04:08 PM
Data Sourced
via MITRE·04:08 PM
Description

Frequently Asked Questions

1

What systems are exposed to this issue?

Linux kernel systems using the md driver’s llbitmap functionality are relevant. The race involves readers such as /proc/mdstat accessing bitmap statistics while llbitmap creation fails.

2

What conditions are needed to trigger the use-after-free?

An llbitmap creation attempt must publish mddev->bitmap and then fail while reading the bitmap superblock. A concurrent mutex-protected reader must access bitmap information after the failed path releases bitmap_info.mutex but before the stale pointer is cleared.

3

How can I tell whether the fix is present?

The corrected behavior clears mddev->bitmap while bitmap_info.mutex is still held, and frees the failed llbitmap only after releasing that mutex. Check the applicable kernel source or stable commit history for this ordering in the llbitmap create-failure cleanup path.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203