Cloudanix VulnDB

CVE-2026-90276

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A memory-handling mistake in Linux storage software can let a local attacker crash the computer or take control during certain shutdown operations.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in md-llbitmap destroy path where daemon_work can rearm pending_timer after llbitmap free, dereferencing freed memory.

Why it matters to the business

Kernel instability or local privilege escalation on systems using Linux md RAID with llbitmap; low exploitation likelihood reduces urgency but still requires patching within normal cycles.

How an attack unfolds

An attacker with local access triggers llbitmap teardown (e.g., array teardown) to race daemon_work against shutdown, allowing timer rearm and subsequent freed-memory access.

How to fix it

Apply upstream patch adding BITMAP_SHUTDOWN flag, timer_shutdown_sync, and early daemon cancellation; rebuild and reboot to patched kernel.

How to confirm the fix worked

Confirm kernel source contains BITMAP_SHUTDOWN handling and timer_shutdown_sync calls in md-llbitmap; test array teardown under load for absence of use-after-free reports.

Typical attack path

  1. Obtain local code execution on affected kernel
  2. Trigger md array configuration change that invokes llbitmap_destroy
  3. Race daemon_work with shutdown to rearm timer post-free
  4. Access freed memory via armed timer callback

How to detect it

Review kernel crash logs and dmesg for use-after-free reports involving md-llbitmap or pending_timer during array teardown; no public exploitation artifacts known.

What your security team should do

  • Schedule kernel update in next maintenance window given stable low EPSS and no KEV listing
  • Monitor for any EPSS increase over next 30 days
  • Restrict local unprivileged access on systems using md RAID llbitmap until patched

The record

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: stop daemon timer rearm on destroy llbitmap_destroy() deletes pending_timer before flushing md_llbitmap_io_wq. However, daemon_work can still be queued or running after the timer has been deleted, and the daemon path can arm pending_timer again when it finds dirty chunks that are not ready to flush yet. If that happens during teardown, pending_timer can remain armed after llbitmap is freed and later dereference freed memory. Add a BITMAP_SHUTDOWN bit to llbitmap->flags, set it before deleting the timer, and make the timer and daemon paths stop queueing or rearming work once teardown starts. Cancel daemon_work before flushing the shared workqueue so no already queued daemon instance can race with the free. Use timer_shutdown_sync() so a daemon instance that passed the shutdown check before teardown cannot rearm the timer afterward. BITMAP_SHUTDOWN is a runtime-only state. Mask it out when reading and updating the llbitmap superblock so the shutdown state is never loaded from disk or persisted to disk.

Affected packages

Ecosystem Package Introduced Fixed