Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

CVE-2026-46045

Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-787 Escritura fuera de límites
Fecha de publicación:
27/05/2026
Última modificación:
16/06/2026

Descripción

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> md/md-llbitmap: skip reading rdevs that are not in_sync<br /> <br /> When reading bitmap pages from member disks, the code iterates through<br /> all rdevs and attempts to read from the first available one. However,<br /> it only checks for raid_disk assignment and Faulty flag, missing the<br /> In_sync flag check.<br /> <br /> This can cause bitmap data to be read from spare disks that are still<br /> being rebuilt and don&amp;#39;t have valid bitmap information yet. Reading<br /> stale or uninitialized bitmap data from such disks can lead to<br /> incorrect dirty bit tracking, potentially causing data corruption<br /> during recovery or normal operation.<br /> <br /> Add the In_sync flag check to ensure bitmap pages are only read from<br /> fully synchronized member disks that have valid bitmap data.

Productos y versiones vulnerables

CPE Desde Hasta
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.18 (incluyendo) 6.18.27 (excluyendo)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.19 (incluyendo) 7.0.4 (excluyendo)