Executive brief
The Linux kernel's software RAID (md) subsystem had a flaw in how it cleaned up bitmap data structures during shutdown. When stopping a RAID array, the bitmap was destroyed before detaching it from the active system, which allowed pending write operations to access freed memory. This could cause system crashes or undefined behavior in RAID configurations using the new lockless bitmap implementation.
Technical details
The vulnerability is a use-after-free condition in the Linux kernel's md (software RAID) subsystem. The __md_stop() function was calling md_bitmap_destroy() before mddev_detach(), which prevented the bitmap_ops->wait_behind_writes() operation from executing while the bitmap was still alive. The new lockless bitmap (llbitmap) implementation moves the behind-write completion wait to wait_behind_writes() instead of destroy(), so with the old call ordering, RAID1 behind-write completions could access freed memory after md_bitmap_destroy() tore down the bitmap storage. The fix reorders these calls so mddev_detach() runs before md_bitmap_destroy(), allowing pending writes to complete safely before bitmap storage is freed. This affects systems using the new lockless bitmap feature introduced in commit 5ab829f1971d.
Affected products
- Linux Linux kernel Affected versions depend on fix integration; issue introduced in commit 5ab829f1971d
Timeline
- 2026-09-17: disclosed