CVE-2026-90277

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the md/md-llbitmap component. The llbitmap create() function publishes mddev->bitmap before reading the bitmap superblock. If the llbitmap read sb() function fails, the cleanup process previously released the bitmap info.mutex and freed the llbitmap before clearing mddev->bitmap. This allowed readers, such as /proc/mdstat, to access a stale pointer after the mutex was released, as they rely on bitmap info.mutex to ensure the bitmap pointer remains stable during statistics collection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.