Technical impact
The Linux kernel’s raid bitmap handling code in the md/md‑llbitmap subsystem contains an out‑of‑bounds read. While reading bitmap pages it iterates over all raid devices but only checks whether a device has a raid_disk assigned and that it is not flagged as faulty. It neglects to verify the In_sync flag. As a result, bitmap data may be read from spare or rebuilding devices that do not yet contain valid bitmap information. These stale or uninitialized bitmap pages are interpreted as dirty‑bit markers, which can corrupt the RAID’s recovery logic or normal read/write operations, leading to loss or corruption of stored data. The flaw is categorized as a Programming Error (CWE‑821) and an Out‑of‑Bounds Read (CWE‑787).
Affected Systems
This vulnerability exists in the generic Linux kernel image and affects any distribution kernel that contains the unpatched md/md‑llbitmap logic. No specific kernel release or version is listed in the data, so any kernel lacking the patched In_sync flag check remains potentially vulnerable. The vulnerability is present wherever the affected subsystem is compiled into the kernel, regardless of distribution.
Risk and Exploitability
The CVSS score of 7.8 indicates a high severity impact. The EPSS score of < 1% implies a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog and no public exploits are known. Based on the description, it is inferred that exploitation would require a local privileged attacker who can influence RAID rebuild activity or trigger a bitmap read while a device is not fully synchronized. Remote exploitation is unlikely because the flaw is exercised only during normal RAID operations. Given the low EPSS value, the risk of exploitation in the wild is low, but the potential impact—data corruption—warrants mitigation.
Ubuntu USN