vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-45955

md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout

HIGH
7.1
CVSS Score
Published: May 27, 2026 at 12:18 PM UTC
Updated: October 19, 2026 at 08:18 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.1
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout When llbitmap_suspend_timeout() times out waiting for percpu_ref to become zero, it returns -ETIMEDOUT without resurrecting the percpu_ref. The caller (md_llbitmap_daemon_fn) then continues to the next page without calling llbitmap_resume(), leaving the percpu_ref in a killed state permanently. Fix this by resurrecting the percpu_ref before returning the error, ensuring the page control structure remains usable for subsequent operations.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
6.18 ≤ v < 6.18.146.19 ≤ v < 6.19.45ab829f1971dc99f2aac10846c378e67fc875abc6.18
Vendor states this is fixed in 095417d6b669c2dec39a5842ccb94df915f97f54 (fixed)
Vendor states this is fixed in 2446d099350185caeed19ab2c0270451a97296fb (fixed)
Vendor states this is fixed in d119bd2e1643cc023210ff3c6f0657e4f914e71d (fixed)
Vendor states this is fixed in 6.18 (unaffected)
Vendor states this is fixed in 6.18.14 (unaffected)
Vendor states this is fixed in 6.19.4 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

References (3)

Patch
Source: cverecord
https://git.kernel.org/stable/c/095417d6b669c2dec39a5842ccb94df915f97f54
Patch
Source: cverecord
https://git.kernel.org/stable/c/2446d099350185caeed19ab2c0270451a97296fb
Patch
Source: cverecord
https://git.kernel.org/stable/c/d119bd2e1643cc023210ff3c6f0657e4f914e71d

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.1HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfoCWE-404

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card