CVE-2026-45955: md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout

Synopsis

This is a resource-lifecycle bug in the Linux kernel's md/md-llbitmap subsystem, a component that manages write-intent bitmaps for software RAID arrays. An attacker with a low-privilege local account can trigger the defect, which leaves an internal reference counter (percpu_ref) in a permanently killed state after a suspend timeout, corrupting the RAID bitmap page control structure. Successful exploitation allows the attacker to tamper with RAID bitmap integrity and crash the affected subsystem, resulting in data tampering and denial of service. A patched-image rebuild at the fix versions is available on HarborGuard for environments running an affected kernel.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path is required to reach the vulnerable code.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the defect; no administrative credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the fault independently.

• Attack complexityDetail

  The exploit is reliable and condition-free once local access is established; no race conditions or special memory layout is required.

Blast Radius

• Modifies RAID write-intent bitmap structures, corrupting the record of which disk blocks need to be resynced after an unclean shutdown.
• Permanently kills an internal reference counter (percpu_ref), making the affected bitmap page control structure unusable for any subsequent RAID operations.
• Crashes the md-llbitmap subsystem, causing denial of service for the software RAID array managed by that bitmap.
• Does not expose confidential data; impact is limited to integrity and availability of the RAID subsystem.