CVE-2026-72438

md/raid10: fix writes_pending and barrier reference leaks on discard failures

HIGH
7.5
CVSS Score
Published: August 15, 2026 at 05:56 AM UTC
Updated: October 30, 2026 at 01:19 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes_pending and barrier reference leaks on discard failures raid10_make_request() acquires a writes_pending reference with md_write_start() before calling raid10_handle_discard(). Several failure paths in raid10_handle_discard() complete the bio and return without releasing the corresponding reference, causing md_write_end() to be skipped. Call md_write_end() before returning from these failure paths to keep writes_pending accounting balanced. Additionally, discard split allocation failures can occur after wait_barrier() succeeds. Those paths return without calling allow_barrier(), leaking the associated barrier reference. Release the barrier before returning from those paths.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

39db562b3fedb93978a7e42dd216b306740959f85.15.1115.17c9aa889b035fca4598ae985a0f0c76ebbb547ad2
Vendor states this is fixed in 11b35d1906a7277a3d64afe34224133b44327328 (fixed)
Vendor states this is fixed in 393d687131d8aa8c7e4de2cb494438e145d20fc2 (fixed)
Vendor states this is fixed in d1324b41dabd26787559efaeb430643c627c1eb0 (fixed)
Vendor states this is fixed in fea33968592559a55a3f5a96a6386bebcaf988a8 (fixed)
Affected range stops below 5.16, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.17 (unaffected)
Vendor states this is fixed in 6.12.111 (unaffected)
Vendor states this is fixed in 6.18.53 (unaffected)
Vendor states this is fixed in 6.6.160 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card