Executive brief
A vulnerability in the Linux kernel's RAID management component could allow a local user to cause a system crash. The issue occurs during the resizing of storage arrays, where a race condition leads to the system attempting to access memory that has already been freed. This results in a 'General Protection Fault' which impacts the availability of the server or workstation.
Technical details
A use-after-free race condition exists between bitmap_daemon_work() and __bitmap_resize() in the Linux kernel's md (Multiple Device) driver. The daemon iterates over the bitmap storage filemap without proper locking, while the resize path concurrently frees that storage via md_bitmap_file_unmap(). Because the quiesce() function does not stop the md thread, the daemon can access freed pages, triggering a General Protection Fault (GPF) in write_page(). The vulnerability is addressed by ensuring mddev->bitmap_info.mutex is held during the bitmap update to synchronize access. An attacker with local access could exploit this to cause a denial-of-service (system crash).
Affected products
- Linux Linux Kernel 3.5 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-20: other: Patch submitted by developer
- 2026-05-06: disclosed: CVE published
- 2026-05-06: advisory: NVD advisory published
References
- https://git.kernel.org/stable/c/140cc839fbeb1ddb33a8da8811b716d88d3905b7
- https://git.kernel.org/stable/c/46ef85f854dfa9d5226b3c1c46493d79556c9589
- https://git.kernel.org/stable/c/5f73c8b33df9a605a591eab72d43a969600c1f8c
- https://git.kernel.org/stable/c/9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f
- https://git.kernel.org/stable/c/a437e3bf30e32846079e470c1ba5ee790bccdf89
- https://git.kernel.org/stable/c/d3af62411e19752c663fe4f424dbf49d95a4cc7c
- https://git.kernel.org/stable/c/d92b8fac294b5f915c50e65ce4ae2262e53614ec