Medium 4.7Published May 6, 2026

CVE-2026-43163md/bitmap: fix GPF in write_page caused by resize race

Updated under an hour ago (Oct 28, 2026, 6:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-free race between bitmap_daemon_work() and __bitmap_resize(). The daemon iterates over `bitmap->storage.filemap` without locking, while the resize path frees that storage via md_bitmap_file_unmap(). `quiesce()` does not stop the md thread, allowing concurrent access to freed pages. Fix by holding `mddev->bitmap_info.mutex` during the bitmap update.

CVSS: 4.7 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d60b479d177a5735b6b4db6ee5280ef6653f50e7 before 140cc839fbeb1ddb33a8da8811b716d88d3905b7; from d60b479d177a5735b6b4db6ee5280ef6653f50e7 before ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8; from d60b479d177a5735b6b4db6ee5280ef6653f50e7 before d3af62411e19752c663fe4f424dbf49d95a4cc7c; from d60b479d177a5735b6b4db6ee5280ef6653f50e7 before d92b8fac294b5f915c50e65ce4ae2262e53614ec; from d60b479d177a5735b6b4db6ee5280ef6653f50e7 before a437e3bf30e32846079e470c1ba5ee790bccdf89; from d60b479d177a5735b6b4db6ee5280ef6653f50e7 before 9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f; from d60b479d177a5735b6b4db6ee5280ef6653f50e7 before 5f73c8b33df9a605a591eab72d43a969600c1f8c; from d60b479d177a5735b6b4db6ee5280ef6653f50e7 before 46ef85f854dfa9d5226b3c1c46493d79556c9589	CNA record
linux linux_kernel linux:linux_kernel	from 3.5 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/140cc839fbeb1ddb33a8da8811b716d88d3905b7	patch
https://git.kernel.org/stable/c/ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8	patch
https://git.kernel.org/stable/c/d3af62411e19752c663fe4f424dbf49d95a4cc7c	patch
https://git.kernel.org/stable/c/d92b8fac294b5f915c50e65ce4ae2262e53614ec	patch
https://git.kernel.org/stable/c/a437e3bf30e32846079e470c1ba5ee790bccdf89	patch
https://git.kernel.org/stable/c/9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f	patch
https://git.kernel.org/stable/c/5f73c8b33df9a605a591eab72d43a969600c1f8c	patch
https://git.kernel.org/stable/c/46ef85f854dfa9d5226b3c1c46493d79556c9589	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.