CVE-2026-90277

md/md-llbitmap: prevent create failure bitmap UAF

Published Sep 17, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

md/md-llbitmap: prevent create failure bitmap UAF

llbitmap_create() publishes mddev->bitmap before reading the bitmap
superblock. This is needed because llbitmap_read_sb() can initialize a
new bitmap and flush it through helpers that use mddev->bitmap.

If llbitmap_read_sb() fails, the old cleanup dropped bitmap_info.mutex
and freed llbitmap before clearing mddev->bitmap. Readers such as
/proc/mdstat rely on bitmap_info.mutex to keep the bitmap pointer stable
while collecting bitmap stats, so they could observe the stale pointer
after the failed create path released the mutex.

Clear mddev->bitmap while still holding bitmap_info.mutex, then free the
failed llbitmap after dropping the mutex. This makes mutex-protected
readers see either a live bitmap or no bitmap.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5ab829f1971dc99f2aac10846c378e67fc875abc`	affected	< 930cc4f1af5a1afcd545a6ba00e38921ff8401e0
`5ab829f1971dc99f2aac10846c378e67fc875abc`	affected	< 2f0722435ce3a844dbb66b9bb0a18229dcc8739c
`5ab829f1971dc99f2aac10846c378e67fc875abc`	affected	< 2116c2f0a0e547615886900e2ed8c529c016499b

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5ab829f1971dc99f2aac10846c378e67fc875abc,930cc4f1af5a1afcd545a6ba00e38921ff8401e0)`	affected	code_commit	—
`[5ab829f1971dc99f2aac10846c378e67fc875abc,2f0722435ce3a844dbb66b9bb0a18229dcc8739c)`	affected	code_commit	—
`[5ab829f1971dc99f2aac10846c378e67fc875abc,2116c2f0a0e547615886900e2ed8c529c016499b)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.18`	affected	semver	—
`[0,6.18)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2116c2f0a0e547615886900e2ed8c529c016499b
https://git.kernel.org/stable/c/2f0722435ce3a844dbb66b9bb0a18229dcc8739c
https://git.kernel.org/stable/c/930cc4f1af5a1afcd545a6ba00e38921ff8401e0

History

Sep 19, 2026 4:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sep 17, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmap_create() publishes mddev->bitmap before reading the bitmap superblock. This is needed because llbitmap_read_sb() can initialize a new bitmap and flush it through helpers that use mddev->bitmap. If llbitmap_read_sb() fails, the old cleanup dropped bitmap_info.mutex and freed llbitmap before clearing mddev->bitmap. Readers such as /proc/mdstat rely on bitmap_info.mutex to keep the bitmap pointer stable while collecting bitmap stats, so they could observe the stale pointer after the failed create path released the mutex. Clear mddev->bitmap while still holding bitmap_info.mutex, then free the failed llbitmap after dropping the mutex. This makes mutex-protected readers see either a live bitmap or no bitmap.
Title		md/md-llbitmap: prevent create failure bitmap UAF
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2116c2f0a0e547615886900e2ed8c529c016499b https://git.kernel.org/stable/c/2f0722435ce3a844dbb66b9bb0a18229dcc8739c https://git.kernel.org/stable/c/930cc4f1af5a1afcd545a6ba00e38921ff8401e0