CVE-2026-90277 md/md-llbitmap: prevent create failure bitmap UAF
A use-after-free in the Linux kernel md/llbitmap module allows local attackers to execute code or escalate privileges via race conditions during bitmap creation failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90277?
CVE-2026-90277 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
md/md-llbitmap: prevent create failure bitmap UAF
llbitmap_create() publishes mddev->bitmap before reading the bitmap superblock. This is needed because llbitmap_read_sb() can initialize a new bitmap and flush it through helpers that use mddev->bitmap.
If llbitmap_read_sb() fails, the old cleanup dropped bitmap_info.mutex and freed llbitmap before clearing mddev->bitmap. Readers such as /proc/mdstat rely on bitmap_info.mutex to keep the bitmap pointer stable while collecting bitmap stats, so they could observe the stale pointer after the failed create path released the mutex.
Clear mddev->bitmap while still holding bitmap_info.mutex, then free the failed llbitmap after dropping the mutex. This makes mutex-protected readers see either a live bitmap or no bitmap.
Which versions are affected by CVE-2026-90277?
How do I fix CVE-2026-90277?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-90277 being exploited?
There is no known exploitation of CVE-2026-90277 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-90277, DEBIAN-CVE-2026-90277, GHSA-x88w-2pq9-75r8, UBUNTU-CVE-2026-90277.