Executive brief
The Linux kernel's RAID management (md) subsystem contains a use-after-free vulnerability in the lockless bitmap creation code. When bitmap initialization fails, the kernel could expose a dangling pointer to readers accessing RAID metadata statistics through /proc/mdstat, potentially causing system crashes or information disclosure.
Technical details
The vulnerability is a use-after-free in llbitmap_create() within drivers/md/md-llbitmap.c. The function publishes mddev->bitmap before reading the bitmap superblock (required because llbitmap_read_sb() may initialize a new bitmap). If llbitmap_read_sb() fails, the old cleanup released bitmap_info.mutex and freed llbitmap before clearing mddev->bitmap. Concurrent readers—such as /proc/mdstat parsing—rely on bitmap_info.mutex to keep the bitmap pointer stable while collecting statistics, allowing them to observe a stale freed pointer after the failed create path released the mutex. The fix moves the mddev->bitmap = NULL assignment to occur while bitmap_info.mutex is still held, ensuring mutex-protected readers see either a live bitmap or NULL. This is a local denial-of-service vector requiring system access to trigger bitmap creation failures.
Affected products
- Linux Linux Kernel All versions after commit 5ab829f1971d (md/md-llbitmap: introduce new lockless bitmap)
Timeline
- 2026-09-17: disclosed
- 2026-08-03: patched