CVE-2026-90277

A flaw was found in the Linux kernel's md/md-llbitmap component. This vulnerability occurs when a bitmap creation fails, leading to a Use-After-Free UAF condition where the system might attempt to access memory that has already been released. A local attacker could potentially exploit this flaw t...

CVE-2026-90276

A flaw was found in the md/md-llbitmap component of the Linux kernel. During the teardown process, a timing issue can occur where a timer is rearmed after the associated memory has been freed. This can lead to the system attempting to access memory that is no longer allocated, potentially causing...

SUSE CVE-2026-90277

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmapcreate publishes mddev-bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb can initialize a new bitmap and flush it through helpers that use...

SUSE CVE-2026-90276

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: stop daemon timer rearm on destroy llbitmapdestroy deletes pendingtimer before flushing mdllbitmapiowq. However, daemonwork can still be queued or running after the timer has been deleted, and the daemon path can...

EUVD-2026-81870

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmapcreate publishes mddev-bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb can initialize a new bitmap and flush it through helpers that use...

EUVD-2026-81869

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: stop daemon timer rearm on destroy llbitmapdestroy deletes pendingtimer before flushing mdllbitmapiowq. However, daemonwork can still be queued or running after the timer has been deleted, and the daemon path can...

CVE-2026-90277: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmapcreate publishes mddev-bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb can initialize a new bitmap and flush it through helpers that use...

CVE-2026-90276: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: stop daemon timer rearm on destroy llbitmapdestroy deletes pendingtimer before flushing mdllbitmapiowq. However, daemonwork can still be queued or running after the timer has been deleted, and the daemon path can...

PT-2026-94624

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the md/md-llbitmap component where the llbitmap destroy function deletes the pending timer before flushing the md llbitmap io wq workqueue. Because daemon work may sti...

PT-2026-94625

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the md/md-llbitmap component. The llbitmap create function publishes mddev-bitmap before reading the bitmap superblock. If the llbitmap read sb...

CVE-2026-45955 md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: fix percpuref not resurrected on suspend timeout When llbitmapsuspendtimeout times out waiting for percpuref to become zero, it returns -ETIMEDOUT without resurrecting the percpuref. The caller mdllbitmapdaemonfn...

CVE-2026-45955: Improper Resource Shutdown or Release

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: fix percpuref not resurrected on suspend timeout When llbitmapsuspendtimeout times out waiting for percpuref to become zero, it returns -ETIMEDOUT without resurrecting the percpuref. The caller mdllbitmapdaemonfn...

CVE-2026-46045: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: skip reading rdevs that are not insync When reading bitmap pages from member disks, the code iterates through all rdevs and attempts to read from the first available one. However, it only checks for raiddisk...

CVE-2026-46095: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: raise barrier before state machine transition Move the barrier raise operation before calling llbitmapstatemachine in both llbitmapstartwrite and llbitmapstartdiscard. This ensures the barrier is in place before a...