---
id: CVE-2026-43163
title: 'md/bitmap: fix GPF in write_page caused by resize race'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/bitmap: fix GPF in write_page caused by resize race

  A General Protection Fault occurs in write_page() during array resize:
  RIP: 0010:write_page+0x22b/0x3c0 [md_mod]…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 <
    140cc839fbeb1ddb33a8da8811b716d88d3905b7
  - >-
    Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 <
    ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8
  - >-
    Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 <
    d3af62411e19752c663fe4f424dbf49d95a4cc7c
  - >-
    Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 <
    d92b8fac294b5f915c50e65ce4ae2262e53614ec
  - >-
    Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 <
    a437e3bf30e32846079e470c1ba5ee790bccdf89
  - >-
    Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 <
    9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f
  - >-
    Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 <
    5f73c8b33df9a605a591eab72d43a969600c1f8c
  - >-
    Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 <
    46ef85f854dfa9d5226b3c1c46493d79556c9589
  - Linux 3.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:30:05.905186Z'
published: '2026-05-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:34.700Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43163'
references:
  - url: 'https://git.kernel.org/stable/c/140cc839fbeb1ddb33a8da8811b716d88d3905b7'
  - url: 'https://git.kernel.org/stable/c/ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8'
  - url: 'https://git.kernel.org/stable/c/d3af62411e19752c663fe4f424dbf49d95a4cc7c'
  - url: 'https://git.kernel.org/stable/c/d92b8fac294b5f915c50e65ce4ae2262e53614ec'
  - url: 'https://git.kernel.org/stable/c/a437e3bf30e32846079e470c1ba5ee790bccdf89'
  - url: 'https://git.kernel.org/stable/c/9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f'
  - url: 'https://git.kernel.org/stable/c/5f73c8b33df9a605a591eab72d43a969600c1f8c'
  - url: 'https://git.kernel.org/stable/c/46ef85f854dfa9d5226b3c1c46493d79556c9589'
tags:
  - cve.org
epss: 0.00091
epssPercentile: 0.00443
ingestedAt: '2026-11-06T15:54:04.018Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

md/bitmap: fix GPF in write_page caused by resize race

A General Protection Fault occurs in write_page() during array resize:
RIP: 0010:write_page+0x22b/0x3c0 [md_mod]

This is a use-after-free race between bitmap_daemon_work() and
__bitmap_resize(). The daemon iterates over `bitmap->storage.filemap`
without locking, while the resize path frees that storage via
md_bitmap_file_unmap(). `quiesce()` does not stop the md thread,
allowing concurrent access to freed pages.

Fix by holding `mddev->bitmap_info.mutex` during the bitmap update.

## Affected

- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 140cc839fbeb1ddb33a8da8811b716d88d3905b7`
- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8`
- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < d3af62411e19752c663fe4f424dbf49d95a4cc7c`
- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < d92b8fac294b5f915c50e65ce4ae2262e53614ec`
- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < a437e3bf30e32846079e470c1ba5ee790bccdf89`
- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f`
- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 5f73c8b33df9a605a591eab72d43a969600c1f8c`
- `Linux >= d60b479d177a5735b6b4db6ee5280ef6653f50e7 < 46ef85f854dfa9d5226b3c1c46493d79556c9589`
- `Linux 3.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.