CVE-2026-46095 Overview
CVE-2026-46095 is a race condition in the Linux kernel's md-llbitmap subsystem. The flaw exists in the multiple device (MD) RAID bitmap implementation. The barrier raise operation occurred after the call to llbitmap_state_machine() in both llbitmap_start_write() and llbitmap_start_discard(). This ordering allowed the state machine to complete before the barrier was properly established. The upstream fix moves the barrier raise operation before the state machine transition to prevent concurrent operations from observing inconsistent state.
Critical Impact
Improper barrier sequencing in MD RAID bitmap code can lead to race conditions during write and discard operations, potentially causing data consistency issues on software RAID arrays.
Affected Products
- Linux kernel versions containing the md-llbitmap implementation
- Systems using MD (multiple device) software RAID with low-latency bitmap support
- Stable kernel branches referenced by commits 9142f00, 9701d51, and ef4ca3d4
Discovery Timeline
- 2026-05-27 - CVE-2026-46095 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46095
Vulnerability Analysis
The vulnerability resides in the md-llbitmap component of the Linux kernel's MD RAID subsystem. The low-latency bitmap (llbitmap) tracks dirty regions on RAID arrays to accelerate resync after unclean shutdowns. The implementation uses barriers to serialize state transitions and protect concurrent I/O paths.
In the unpatched code, llbitmap_start_write() and llbitmap_start_discard() invoked llbitmap_state_machine() before raising the barrier. The state machine could therefore complete its transition while the barrier was not yet active. Concurrent threads operating on the same bitmap region could observe an inconsistent intermediate state.
The upstream patch reorders the operations so the barrier is raised first. This guarantees that any in-flight operation observes the barrier before the state machine begins its transition.
Root Cause
The root cause is an ordering bug in synchronization primitives. The barrier raise and the state machine transition were not sequenced correctly, producing a Time-of-Check Time-of-Use (TOCTOU) style race window between concurrent write or discard operations on a shared bitmap.
Attack Vector
This is a local kernel issue affecting block layer correctness on systems using MD software RAID with the llbitmap feature. The vulnerability is not exposed to remote attackers. Triggering the race requires concurrent write and discard operations against an MD array configured with llbitmap. The consequence is data consistency risk on the underlying storage rather than direct code execution.
No verified proof-of-concept code has been published. The technical fix is documented in the kernel git commits referenced below.
Detection Methods for CVE-2026-46095
Indicators of Compromise
- Unexpected MD RAID resync events or bitmap inconsistencies recorded in dmesg after high-concurrency write or discard workloads
- Kernel warnings or soft lockups originating in md-llbitmap call paths
- Data integrity check failures on filesystems backed by MD arrays using llbitmap
Detection Strategies
- Inventory running kernels and compare against the patched stable branches referenced in commits 9142f00a9287, 9701d51dd378, and ef4ca3d4bf09
- Monitor kernel logs for stack traces involving llbitmap_start_write, llbitmap_start_discard, or llbitmap_state_machine
- Audit configurations to identify MD arrays using the low-latency bitmap feature
Monitoring Recommendations
- Forward dmesg and /var/log/messages to a centralized log platform for kernel oops and warning correlation
- Track package and kernel version drift across the fleet using configuration management telemetry
- Run periodic filesystem consistency checks on MD-backed volumes to surface latent corruption
How to Mitigate CVE-2026-46095
Immediate Actions Required
- Identify hosts running affected Linux kernels that include the md-llbitmap implementation
- Update to a stable kernel build that incorporates the fix from commits 9142f00, 9701d51, and ef4ca3d4
- Reboot patched systems to load the corrected kernel image
Patch Information
The fix moves the barrier raise operation before the call to llbitmap_state_machine() in both llbitmap_start_write() and llbitmap_start_discard(). Patches are available in upstream stable trees. See Kernel Git Commit 9142f00, Kernel Git Commit 9701d51, and Kernel Git Commit ef4ca3d4.
Workarounds
- Where patching is not immediately possible, avoid enabling the llbitmap feature on MD RAID arrays
- Reduce concurrent write and discard workloads against affected MD arrays until the patched kernel is deployed
- Maintain validated backups of data residing on MD volumes during the remediation window
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
