CVE-2026-90278 md: wait for behind writes before destroying bitmap
A use-after-free in the Linux kernel md driver allows attackers to cause denial of service or execute code by triggering RAID1 behind-write completions after bitmap destruction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90278?
CVE-2026-90278 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
md: wait for behind writes before destroying bitmap
__md_stop() destroyed the bitmap before calling mddev_detach(). That made mddev_detach() skip bitmap_ops->wait_behind_writes(), because the bitmap was already disconnected from mddev.
This was still safe for the legacy bitmap because bitmap_destroy() waits for behind writes itself. llbitmap keeps that wait in its ->wait_behind_writes() operation instead, while ->destroy() tears down the llbitmap storage. With the old ordering, RAID1 behind-write completions could still run after llbitmap storage had been freed.
Call mddev_detach() before md_bitmap_destroy() so the common detach path can wait for behind writes while the bitmap is still alive. Only destroy the bitmap after those users are gone.
Which versions are affected by CVE-2026-90278?
How do I fix CVE-2026-90278?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-90278 being exploited?
There is no known exploitation of CVE-2026-90278 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-90278, DEBIAN-CVE-2026-90278, GHSA-2jp5-w8mw-wp2x, UBUNTU-CVE-2026-90278.