Executive brief
A vulnerability in the Linux kernel's RAID management system could lead to data corruption. The system responsible for tracking changes to disks (the bitmap) may accidentally read data from a new or spare disk that hasn't finished synchronizing yet. This can result in the system losing track of which data is current, potentially leading to permanent data loss or corruption during normal operations or disk recovery.
Technical details
A logic error exists in the md/md-llbitmap component of the Linux kernel's Multiple Device (MD) driver. When the `llbitmap_read_page` function iterates through member devices (rdevs) to read bitmap pages, it fails to verify the 'In_sync' flag. Consequently, the kernel may attempt to read bitmap data from spare disks that are still being rebuilt. Because these disks contain stale or uninitialized bitmap information, the resulting incorrect dirty bit tracking can lead to data corruption during RAID recovery or standard I/O operations. The fix introduces a check for the 'In_sync' flag to ensure only fully synchronized disks are used for bitmap reads.
Affected products
- Linux Linux Kernel Versions including md-llbitmap component
Timeline
- 2026-02-23: other: Patch authored
- 2026-05-27: disclosed: CVE published