CVE-2026-90278

A flaw was found in the Linux kernel's Multiple Device (MD) driver, specifically in how it handles bitmap destruction. When the __md_stop() function was called, it destroyed the bitmap before ensuring all pending write operations were complete. This could lead to RAID1 behind-write completions attempting to access freed memory, resulting in memory corruption. An attacker could potentially leverage this to cause system instability or a denial of service.

md __md_stop() could destroy the bitmap before mddev_detach() had a chance to wait for RAID1 behind write completions. With llbitmap, the wait is implemented in wait_behind_writes() while destroy() tears down the llbitmap storage, so completions may run after the storage has been freed. This is a local race and use-after-free candidate in the md storage path and can at least cause denial of service via kernel crash or corrupted md bitmap state. For the CVSS the PR:L is used for the paranoid score because md control may be delegated to a storage management service, reduced capability root, or another local process with limited but relevant administrative access. The issue is not directly network reachable and requires local control of md stop or detach behavior plus outstanding behind writes. Impact is at least local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.