Cloudanix VulnDB

CVE-2026-90278

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux disk-array handling could let the system crash or corrupt memory if certain writes are still finishing when an array is being shut down.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Other
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Linux md RAID bitmap handling: __md_stop destroys the llbitmap before mddev_detach can invoke wait_behind_writes, allowing RAID1 behind-write completions to access freed storage.

Why it matters to the business

Linux systems running software RAID1 arrays with bitmaps may experience kernel crashes, memory corruption, or instability during array stop or reconfiguration operations.

How an attack unfolds

An attacker with local access triggers array stop paths while pending behind writes exist; the freed llbitmap storage is then accessed by in-flight completion handlers, resulting in use-after-free.

How to fix it

Apply the upstream kernel fix that calls mddev_detach before md_bitmap_destroy so the common detach path can wait for behind writes while the bitmap is still valid.

How to confirm the fix worked

Confirm the source change reorders mddev_detach ahead of md_bitmap_destroy in __md_stop and test that RAID1 arrays with bitmaps shut down cleanly without use-after-free reports.

Typical attack path

  1. Obtain local access on a system using md RAID1 with llbitmap enabled
  2. Arrange for pending behind writes on the array
  3. Trigger __md_stop or equivalent array teardown
  4. Trigger behind-write completion after bitmap storage is freed

How to detect it

Search kernel logs for oops or slab-use-after-free reports referencing md_bitmap, llbitmap, or RAID1 behind-write completions around array stop events.

What your security team should do

  • Prioritize kernel updates on systems using md RAID with bitmaps
  • Monitor for kernel oops involving md bitmap or RAID1 completion paths
  • Review RAID configurations for llbitmap usage and consider disabling bitmaps where not required

The record

In the Linux kernel, the following vulnerability has been resolved: md: wait for behind writes before destroying bitmap __md_stop() destroyed the bitmap before calling mddev_detach(). That made mddev_detach() skip bitmap_ops->wait_behind_writes(), because the bitmap was already disconnected from mddev. This was still safe for the legacy bitmap because bitmap_destroy() waits for behind writes itself. llbitmap keeps that wait in its ->wait_behind_writes() operation instead, while ->destroy() tears down the llbitmap storage. With the old ordering, RAID1 behind-write completions could still run after llbitmap storage had been freed. Call mddev_detach() before md_bitmap_destroy() so the common detach path can wait for behind writes while the bitmap is still alive. Only destroy the bitmap after those users are gone.

Affected packages

Ecosystem Package Introduced Fixed