Linux Kernel EUVD-2026-32427

The flaw lives in drivers/md/md-llbitmap.c, part of Linux's software RAID (md) stack that implements the log-less ('llbitmap') variant of the write-intent bitmap. The bitmap records which array regions are 'dirty' and must be resynchronized after an unclean shutdown or device replacement. When reading bitmap pages from member rdevs, the original logic accepted any rdev with raid_disk >= 0 that was not Faulty, but a spare added for rebuild is in exactly that state while its contents - including the on-disk bitmap region - are still uninitialized or stale. The CWE-787 (out-of-bounds write) and 'Memory Corruption / Buffer Overflow' tags supplied with this CVE are misleading: the actual root cause is a missing precondition check (closer to CWE-754 / improper validation of state) that leads to logical data corruption rather than a memory-safety overflow. The fix is to require the In_sync flag, ensuring only fully synchronized members supply bitmap data. Affected CPE is cpe:2.3:o:linux:linux_kernel:*.