CVE-2026-43163
Description
In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-free race between bitmap_daemon_work() and __bitmap_resize(). The daemon iterates over `bitmap->storage.filemap` without locking, while the resize path frees that storage via md_bitmap_file_unmap(). `quiesce()` does not stop the md thread, allowing concurrent access to freed pages. Fix by holding `mddev->bitmap_info.mutex` during the bitmap update.
How to fix
- linux linux_kernel5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6 or later
- git.kernel.org/stable/c/140cc839fbeb1ddb33a8da8811b716d88d3905b7
- git.kernel.org/stable/c/46ef85f854dfa9d5226b3c1c46493d79556c9589
- git.kernel.org/stable/c/5f73c8b33df9a605a591eab72d43a969600c1f8c
- git.kernel.org/stable/c/9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f
- git.kernel.org/stable/c/a437e3bf30e32846079e470c1ba5ee790bccdf89
- git.kernel.org/stable/c/d3af62411e19752c663fe4f424dbf49d95a4cc7c
- git.kernel.org/stable/c/d92b8fac294b5f915c50e65ce4ae2262e53614ec
- git.kernel.org/stable/c/ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.5 ≤ v < 5.10.252, 5.11 ≤ v < 5.15.202, 5.16 ≤ v < 6.1.165, 6.2 ≤ v < 6.6.128, 6.7 ≤ v < 6.12.75, 6.13 ≤ v < 6.18.16, 6.19 ≤ v < 6.19.6 | 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.