CVE-2026-72438

Received Received - Intake

Memory Leak in Linux Kernel RAID10

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes_pending and barrier reference leaks on discard failures raid10_make_request() acquires a writes_pending reference with md_write_start() before calling raid10_handle_discard(). Several failure paths in raid10_handle_discard() complete the bio and return without releasing the corresponding reference, causing md_write_end() to be skipped. Call md_write_end() before returning from these failure paths to keep writes_pending accounting balanced. Additionally, discard split allocation failures can occur after wait_barrier() succeeds. Those paths return without calling allow_barrier(), leaking the associated barrier reference. Release the barrier before returning from those paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72438

EUVD

EUVD-2026-59337

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of reference counts during discard operations in RAID10 configurations. When raid10_handle_discard() fails, it does not release a writes_pending reference acquired earlier, causing md_write_end() to be skipped. Additionally, some discard split allocation failures leak barrier references by not calling allow_barrier().

Detection Guidance

This vulnerability is specific to the Linux kernel's RAID10 implementation. Detection requires checking kernel logs for discard failures or RAID10-related errors. Use commands like dmesg | grep raid10 or journalctl -k | grep discard to identify issues. Ensure your kernel version is up to date to confirm if the fix is applied.

Impact Analysis

This could lead to system instability or crashes due to unbalanced reference counts. It may cause memory leaks or resource exhaustion in systems using RAID10 with discard operations, potentially disrupting storage operations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a specific Linux kernel RAID10 implementation issue. Compliance impacts would depend on system configuration and data handling practices rather than this technical flaw.

Mitigation Strategies

Apply the latest kernel updates to ensure the fix is included. If updating is not immediately possible, avoid using RAID10 configurations or discard operations until patched. Monitor system logs for discard-related errors as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-72438. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70