CVE-2026-46045: Linux Kernel Privilege Escalation Flaw

CVE-2026-46045 Overview

CVE-2026-46045 is a Linux kernel vulnerability in the md-llbitmap subsystem that manages bitmap data for software RAID arrays. The flaw stems from missing validation when reading bitmap pages from member disks. The bitmap read path iterates through rdevs and selects the first available device by checking only raid_disk assignment and the Faulty flag, omitting the In_sync flag check. This can cause the kernel to read bitmap data from spare disks still undergoing rebuild, returning stale or uninitialized content. The condition can produce incorrect dirty bit tracking, leading to potential data corruption during recovery or normal RAID operation.

Critical Impact
Reading uninitialized bitmap pages from rebuilding spare disks can lead to incorrect dirty bit tracking and silent data corruption in MD RAID arrays.

Affected Products

Linux kernel versions containing the md-llbitmap implementation prior to the fix commits
Systems using MD (multiple device) software RAID with low-level bitmap support
Storage stacks relying on MD RAID with spare or rebuilding member disks

Discovery Timeline

2026-05-27 - CVE-2026-46045 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46045

Vulnerability Analysis

The defect resides in the md/md-llbitmap code path responsible for retrieving persistent bitmap pages from RAID member devices. The bitmap tracks which regions of the array contain dirty data that may require resynchronization. Correctness of this tracking is essential for safe recovery after unclean shutdowns or device failures.

When the bitmap layer reads pages, it walks the array's rdev list to locate a usable source. The original logic accepted any device that had a valid raid_disk index and was not marked Faulty. A spare disk added to the array satisfies both checks before its rebuild has completed. Its bitmap region, however, has not yet been populated with valid data and may contain stale or zeroed contents.

If the bitmap subsystem reads from such an out-of-sync device, the resulting in-memory bitmap reflects the wrong set of dirty regions. Subsequent recovery operations may skip regions that should be resynchronized or unnecessarily rewrite clean regions, both of which can result in data corruption.

Root Cause

The root cause is an incomplete predicate when selecting a bitmap source device. The code checks raid_disk >= 0 and the absence of the Faulty flag but does not verify the In_sync flag. The In_sync flag indicates that a member disk holds a fully consistent copy of the array data, including valid on-disk bitmap pages. Omitting this check allows partially populated spares to be treated as authoritative bitmap sources [CWE-908 Use of Uninitialized Resource].

Attack Vector

This is a local data integrity vulnerability rather than a remote exploitation primitive. The bug is triggered under normal administrative operations such as adding a spare to a RAID array, recovering from a degraded state, or restarting an array during a rebuild. No attacker-controlled input is required. The vulnerability manifests during legitimate kernel operations whenever the bitmap read path selects an out-of-sync rdev as its source. Full technical details and the corrective patches are available in the upstream commits referenced by the Kernel Git Commit 3115fa2, Kernel Git Commit 7701e68, and Kernel Git Commit 98623c7.

No verified public exploit code is available. The vulnerability is described in prose because no proof-of-concept is published.

Detection Methods for CVE-2026-46045

Indicators of Compromise

Unexpected data inconsistencies on MD RAID volumes following a rebuild or recovery cycle
Kernel logs showing bitmap read operations during periods when a spare disk has not yet reached In_sync state
Filesystem-level corruption reports on arrays that recently completed resynchronization
Mismatch between mdadm --examine-bitmap output across member devices in the same array

Detection Strategies

Inventory all hosts running affected kernels and identify those configured with MD RAID and low-level bitmap support
Compare running kernel versions against the fixed commits referenced in the upstream stable tree
Correlate filesystem consistency check (fsck) failures with recent RAID rebuild events
Audit dmesg and /var/log/messages for md/raid and bitmap subsystem entries during spare reintroduction

Monitoring Recommendations

Track mdadm --detail output for arrays transitioning through degraded, recovery, and clean states
Alert on RAID rebuild events that complete without expected bitmap progress reporting
Monitor block-layer metrics for unexpected write patterns following array recovery
Aggregate kernel storage subsystem logs into a centralized analytics platform for cross-host correlation

How to Mitigate CVE-2026-46045

Immediate Actions Required

Identify hosts running Linux kernels that include md-llbitmap without the upstream fix
Schedule kernel updates to a version containing the patches from the referenced stable commits
Avoid initiating spare additions or rebuilds on unpatched systems where possible until updates are applied
Back up MD RAID volumes before performing kernel upgrades or rebuild operations

Patch Information

The fix adds the In_sync flag check to the bitmap page read selection logic, ensuring bitmap data is sourced only from fully synchronized member disks. The corrective changes are available in upstream commits 3115fa2, 7701e68, and 98623c7. Apply distribution-provided kernel updates that incorporate these commits.

Workarounds

Delay adding spare disks to MD RAID arrays until kernels are patched
For non-critical arrays, allow rebuilds to fully complete and reach In_sync before relying on bitmap-driven recovery
Where feasible, disable low-level bitmap mode on affected arrays until patched kernels are deployed
Maintain verified backups and run filesystem consistency checks after any rebuild on unpatched systems

bash

# Verify kernel version and inspect MD RAID and bitmap status
uname -r
cat /proc/mdstat
mdadm --detail /dev/md0
mdadm --examine-bitmap /dev/sdX1