CVE-2026-46045

Severity CVSS v4.0:
Pending analysis
Type:
CWE-787 Out-of-bounds Write
Publication date:
27/05/2026
Last modified:
16/06/2026

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> md/md-llbitmap: skip reading rdevs that are not in_sync<br /> <br /> When reading bitmap pages from member disks, the code iterates through<br /> all rdevs and attempts to read from the first available one. However,<br /> it only checks for raid_disk assignment and Faulty flag, missing the<br /> In_sync flag check.<br /> <br /> This can cause bitmap data to be read from spare disks that are still<br /> being rebuilt and don&amp;#39;t have valid bitmap information yet. Reading<br /> stale or uninitialized bitmap data from such disks can lead to<br /> incorrect dirty bit tracking, potentially causing data corruption<br /> during recovery or normal operation.<br /> <br /> Add the In_sync flag check to ensure bitmap pages are only read from<br /> fully synchronized member disks that have valid bitmap data.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.18 (including) 6.18.27 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.19 (including) 7.0.4 (excluding)