CVE-2026-90276

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the md/md-llbitmap component where the llbitmap destroy() function deletes the pending timer before flushing the md llbitmap io wq workqueue. Because daemon work may still be queued or running, the daemon path can re-arm the pending timer if dirty chunks are found that are not yet ready to flush. During teardown, this can result in the pending timer remaining armed after the llbitmap has been freed, leading to a dereference of freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.