CVE-2026-90278

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md: wait for behind writes before destroying bitmap

__md_stop() destroyed the bitmap before calling mddev_detach(). That made

mddev_detach() skip bitmap_ops->wait_behind_writes(), because the bitmap

was already disconnected from mddev.

This was still safe for the legacy bitmap because bitmap_destroy() waits

for behind writes itself. llbitmap keeps that wait in its

->wait_behind_writes() operation instead, while ->destroy() tears down the

llbitmap storage. With the old ordering, RAID1 behind-write completions

could still run after llbitmap storage had been freed.

Call mddev_detach() before md_bitmap_destroy() so the common detach path

can wait for behind writes while the bitmap is still alive. Only destroy

the bitmap after those users are gone.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References