CVE-2026-90277

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md/md-llbitmap: prevent create failure bitmap UAF

llbitmap_create() publishes mddev->bitmap before reading the bitmap

superblock. This is needed because llbitmap_read_sb() can initialize a

new bitmap and flush it through helpers that use mddev->bitmap.

If llbitmap_read_sb() fails, the old cleanup dropped bitmap_info.mutex

and freed llbitmap before clearing mddev->bitmap. Readers such as

/proc/mdstat rely on bitmap_info.mutex to keep the bitmap pointer stable

while collecting bitmap stats, so they could observe the stale pointer

after the failed create path released the mutex.

Clear mddev->bitmap while still holding bitmap_info.mutex, then free the

failed llbitmap after dropping the mutex. This makes mutex-protected

readers see either a live bitmap or no bitmap.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References