UBUNTU-CVE-2026-90277: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmapcreate() publishes mddev->bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb() can initialize a new bitmap and flush it through helpers that use mddev->bitmap. If llbitmapreadsb() fails, the old cleanup dropped bitmapinfo.mutex and freed llbitmap before clearing mddev->bitmap. Readers such as /proc/mdstat rely on bitmapinfo.mutex to keep the bitmap pointer stable while collecting bitmap stats, so they could observe the stale pointer after the failed create path released the mutex. Clear mddev->bitmap while still holding bitmapinfo.mutex, then free the failed llbitmap after dropping the mutex. This makes mutex-protected readers see either a live bitmap or no bitmap.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which deployments are most likely to encounter this issue?
The affected software list includes Ubuntu linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0 kernels. The unsafe state requires an MD llbitmap creation attempt to fail after the bitmap has been published.
What concurrent activity is needed for the use-after-free condition?
A reader must access the bitmap after the failed creation path releases bitmap_info.mutex but before mddev->bitmap is cleared. The description specifically identifies /proc/mdstat as a reader that can collect bitmap statistics during this window.
What behavior does the resolved implementation change?
It clears mddev->bitmap while bitmap_info.mutex is still held, then frees the failed llbitmap after releasing the mutex. Mutex-protected readers should therefore observe either a valid bitmap or no bitmap rather than a stale pointer.