Executive brief
A vulnerability was identified in the Linux kernel's Multiple Device (MD) driver, which manages software RAID storage. A logic error in the lockless bitmap component can cause the system to permanently disable certain internal control structures if a specific operation times out. This could lead to storage management issues or system instability, potentially impacting the availability of data stored on RAID volumes.
Technical details
A vulnerability exists in the Linux kernel's md-llbitmap driver due to improper state management in the llbitmap_suspend_timeout() function. When this function times out while waiting for a percpu_ref to reach zero, it returns -ETIMEDOUT without resurrecting the reference counter. Consequently, the caller (md_llbitmap_daemon_fn) proceeds to subsequent operations while the page control structure remains in a killed state permanently. This prevents the affected page control structures from being reused, leading to a persistent degraded state for the bitmap management. The issue has been resolved by ensuring percpu_ref_resurrect() is called upon a timeout.
Affected products
- Linux Linux Kernel Introduced in 5ab829f1971d
Timeline
- 2026-01-24: other: Patch authored
- 2026-05-27: advisory: NVD publication date