PT-2026-37503 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-28 · CVE-2026-43163

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free race condition exists between the bitmap daemon work() and bitmap resize() functions. The daemon iterates over bitmap->storage.filemap without proper locking, while the resize process frees that storage using md bitmap file unmap(). Because quiesce() fails to stop the md thread, concurrent access to freed pages can occur, leading to a General Protection Fault (GPF)—a type of error occurring when the processor detects a memory access violation—within the write page() function during an array resize.

Recommendations Apply the update that ensures mddev->bitmap info.mutex is held during the bitmap update.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALSA-2026:21706

ALSA-2026:21745

CVE-2026-43163

Affected Products

Linux Kernel

References · 59

• https://cve.org/CVERecord?id=CVE-2026-43163 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43163 · Vendor Advisory
• https://git.kernel.org/stable/c/d3af62411e19752c663fe4f424dbf49d95a4cc7c · Patch
• https://osv.dev/vulnerability/ALSA-2026:21706 · Vendor Advisory
• https://git.kernel.org/stable/c/5f73c8b33df9a605a591eab72d43a969600c1f8c · Patch
• https://errata.almalinux.org/8/ALSA-2026-21706.html · Vendor Advisory
• https://git.kernel.org/stable/c/140cc839fbeb1ddb33a8da8811b716d88d3905b7 · Patch
• https://git.kernel.org/stable/c/ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8 · Patch
• https://git.kernel.org/stable/c/a437e3bf30e32846079e470c1ba5ee790bccdf89 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43163 · Vendor Advisory
• https://git.kernel.org/stable/c/d92b8fac294b5f915c50e65ce4ae2262e53614ec · Patch
• https://errata.almalinux.org/8/ALSA-2026-21745.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43163 · Vendor Advisory
• https://git.kernel.org/stable/c/9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43163 · Vendor Advisory