Executive brief
The Linux kernel's md (multiple device/RAID) subsystem contains a use-after-free vulnerability in the lockless bitmap code. During system shutdown or device destruction, timer operations can continue to reference freed memory, potentially causing a kernel crash or memory corruption. This affects systems using software RAID configurations.
Technical details
The vulnerability is a use-after-free in the llbitmap_destroy() function. The code deletes a pending_timer before flushing the md_llbitmap_io_wq workqueue, but daemon_work can still be queued or running after timer deletion. The daemon path can rearm the pending_timer when dirty chunks are found, causing the timer to remain armed after llbitmap is freed. An attacker with the ability to trigger destruction of a RAID device (local/privileged) can cause a kernel panic. The fix introduces a BITMAP_SHUTDOWN flag to prevent timer and daemon rearm during teardown, uses timer_shutdown_sync() for safe cleanup, and masks out the shutdown state when persisting bitmap superblocks. No authentication is required; only local access/configuration capability is needed.
Affected products
- Linux Linux kernel affected in md/md-llbitmap component since introduction of lockless bitmap (5ab829f1971d)
Timeline
- 2026-09-17: disclosed
- 2026-08-03: patched: Upstream fix commit 5553d64e01d9a995be6c3de38501c6dd4ceede3b
- 2026-09-14: patched: Stable kernel backport commit bb7f92d58fca9a9f06f3f51a82481c5f0bbbd46c