{"id":"CVE-2026-90278","summary":"md: wait for behind writes before destroying bitmap","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: wait for behind writes before destroying bitmap\n\n__md_stop() destroyed the bitmap before calling mddev_detach(). That made\nmddev_detach() skip bitmap_ops-\u003ewait_behind_writes(), because the bitmap\nwas already disconnected from mddev.\n\nThis was still safe for the legacy bitmap because bitmap_destroy() waits\nfor behind writes itself. llbitmap keeps that wait in its\n-\u003ewait_behind_writes() operation instead, while -\u003edestroy() tears down the\nllbitmap storage. With the old ordering, RAID1 behind-write completions\ncould still run after llbitmap storage had been freed.\n\nCall mddev_detach() before md_bitmap_destroy() so the common detach path\ncan wait for behind writes while the bitmap is still alive. Only destroy\nthe bitmap after those users are gone.","modified":"2026-09-19T03:47:25.787831244Z","published":"2026-09-17T16:08:09.992Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90278.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/2a79365b2278f16e163e4024086105693b421601"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4224dccd325a9380e8edfb66aad8bb5771c94222"},{"type":"WEB","url":"https://git.kernel.org/stable/c/73881ff7a75913f919a1ce9d9571bfaab8e8588d"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90278.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90278"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5ab829f1971dc99f2aac10846c378e67fc875abc"},{"fixed":"73881ff7a75913f919a1ce9d9571bfaab8e8588d"},{"fixed":"4224dccd325a9380e8edfb66aad8bb5771c94222"},{"fixed":"2a79365b2278f16e163e4024086105693b421601"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90278.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.18.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90278.json"}}],"schema_version":"1.9.0"}