{"id":"CVE-2026-90278","revision":"aa2d5a5455424d1bbdaec649e96f8f65","records":[{"revision":"aa2d5a5455424d1bbdaec649e96f8f65","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90278","aliases":[],"title":"md: wait for behind writes before destroying bitmap","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: wait for behind writes before destroying bitmap\n\n__md_stop() destroyed the bitmap before calling mddev_detach(). That made\nmddev_detach() skip bitmap_ops->wait_behind_writes(), because the bitmap\nwas already disconnected from mddev.\n\nThis was still safe for the legacy bitmap because bitmap_destroy() waits\nfor behind writes itself. llbitmap keeps that wait in its\n->wait_behind_writes() operation instead, while ->destroy() tears down the\nllbitmap storage. With the old ordering, RAID1 behind-write completions\ncould still run after llbitmap storage had been freed.\n\nCall mddev_detach() before md_bitmap_destroy() so the common detach path\ncan wait for behind writes while the bitmap is still alive. Only destroy\nthe bitmap after those users are gone.","state":0,"publishedAt":"2026-09-17T16:08:09.992+00:00","modifiedAt":"2026-10-19T09:00:55.904+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/md.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5ab829f1971dc99f2aac10846c378e67fc875abc\",\n                            \"lessThan\": \"73881ff7a75913f919a1ce9d9571bfaab8e8588d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ab829f1971dc99f2aac10846c378e67fc875abc\",\n                            \"lessThan\": \"4224dccd325a9380e8edfb66aad8bb5771c94222\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ab829f1971dc99f2aac10846c378e67fc875abc\",\n                            \"lessThan\": \"2a79365b2278f16e163e4024086105693b421601\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/md.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/73881ff7a75913f919a1ce9d9571bfaab8e8588d","https://git.kernel.org/stable/c/4224dccd325a9380e8edfb66aad8bb5771c94222","https://git.kernel.org/stable/c/2a79365b2278f16e163e4024086105693b421601"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90278","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90278","identifiers":["CVE-2026-90278"]},"retained":false,"historicalAffected":[]}],"coverage":[]}