{"id":"CVE-2026-43163","title":"md/bitmap: fix GPF in write_page caused by resize race","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/bitmap: fix GPF in write_page caused by resize race\n\nA General Protection Fault occurs in write_page() during array resize:\nRIP: 0010:write_page+0x22b/0x3c0 [md_mod]…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 140cc839fbeb1ddb33a8da8811b716d88d3905b7","Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8","Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < d3af62411e19752c663fe4f424dbf49d95a4cc7c","Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < d92b8fac294b5f915c50e65ce4ae2262e53614ec","Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < a437e3bf30e32846079e470c1ba5ee790bccdf89","Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f","Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 5f73c8b33df9a605a591eab72d43a969600c1f8c","Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 46ef85f854dfa9d5226b3c1c46493d79556c9589","Linux 3.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:30:05.905186Z"},"published":"2026-05-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:34.700Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43163","references":[{"url":"https://git.kernel.org/stable/c/140cc839fbeb1ddb33a8da8811b716d88d3905b7"},{"url":"https://git.kernel.org/stable/c/ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8"},{"url":"https://git.kernel.org/stable/c/d3af62411e19752c663fe4f424dbf49d95a4cc7c"},{"url":"https://git.kernel.org/stable/c/d92b8fac294b5f915c50e65ce4ae2262e53614ec"},{"url":"https://git.kernel.org/stable/c/a437e3bf30e32846079e470c1ba5ee790bccdf89"},{"url":"https://git.kernel.org/stable/c/9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f"},{"url":"https://git.kernel.org/stable/c/5f73c8b33df9a605a591eab72d43a969600c1f8c"},{"url":"https://git.kernel.org/stable/c/46ef85f854dfa9d5226b3c1c46493d79556c9589"}],"tags":["cve.org"],"epss":0.00091,"epssPercentile":0.00443,"ingestedAt":"2026-11-06T15:54:04.018Z","slug":"CVE-2026-43163","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/bitmap: fix GPF in write_page caused by resize race\n\nA General Protection Fault occurs in write_page() during array resize:\nRIP: 0010:write_page+0x22b/0x3c0 [md_mod]\n\nThis is a use-after-free race between bitmap_daemon_work() and\n__bitmap_resize(). The daemon iterates over `bitmap->storage.filemap`\nwithout locking, while the resize path frees that storage via\nmd_bitmap_file_unmap(). `quiesce()` does not stop the md thread,\nallowing concurrent access to freed pages.\n\nFix by holding `mddev->bitmap_info.mutex` during the bitmap update.\n\n## Affected\n\n- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 140cc839fbeb1ddb33a8da8811b716d88d3905b7`\n- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8`\n- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < d3af62411e19752c663fe4f424dbf49d95a4cc7c`\n- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < d92b8fac294b5f915c50e65ce4ae2262e53614ec`\n- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < a437e3bf30e32846079e470c1ba5ee790bccdf89`\n- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f`\n- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 5f73c8b33df9a605a591eab72d43a969600c1f8c`\n- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 46ef85f854dfa9d5226b3c1c46493d79556c9589`\n- `Linux 3.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}