CVE-2026-43163

In the Linux kernel, the following vulnerability has been resolved:

md/bitmap: fix GPF in write_page caused by resize race

A General Protection Fault occurs in writepage() during array resize: RIP: 0010:writepage+0x22b/0x3c0 [md_mod]

This is a use-after-free race between bitmapdaemonwork() and __bitmapresize(). The daemon iterates over bitmap->storage.filemap without locking, while the resize path frees that storage via mdbitmapfileunmap(). quiesce() does not stop the md thread, allowing concurrent access to freed pages.

Fix by holding mddev->bitmap_info.mutex during the bitmap update.