CVE-2026-90276

CVE-2026-90276 is a use-after-free in the Linux kernel's md/md-llbitmap (software RAID) subsystem. During llbitmap_destroy(), the pending_timer is deleted before flushing the shared I/O workqueue. However, daemon_work may still be queued or running, and the daemon path can rearm pending_timer whe...