CVE-2026-72440

Received Received - Intake

Linux kernel RAID1 write failure reference leak fix

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writes_pending and barrier reference leaks on write failures raid1_make_request() acquires a writes_pending reference with md_write_start() before calling raid1_write_request(). Several failure paths in raid1_write_request() complete the bio and return without reaching the normal write completion path, causing the corresponding md_write_end() to be skipped. Make raid1_write_request() return a status indicating whether the write request was successfully queued. This allows raid1_make_request() to call md_write_end() when raid1_write_request() fails. Additionally, if wait_blocked_rdev() fails after wait_barrier() succeeds, the associated barrier reference is not released. Call allow_barrier() before returning from that path to keep the barrier accounting balanced.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72440

EUVD

EUVD-2026-59339

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves memory and reference leaks in the RAID1 implementation. When a write operation fails in raid1_write_request(), the system skips normal cleanup steps, leaving writes_pending references and barrier counts unbalanced. This can cause resource exhaustion or deadlocks in the RAID1 subsystem.

Detection Guidance

This vulnerability is specific to the Linux kernel's RAID1 implementation. Detection requires checking kernel logs for RAID1-related errors or examining the kernel version for known vulnerable builds. Commands like dmesg | grep raid1 or checking uname -a for kernel version may help identify affected systems.

Impact Analysis

If exploited, this flaw could lead to system instability, crashes, or degraded performance in RAID1 configurations. It may cause data corruption or prevent proper write operations, affecting storage reliability and availability.

Compliance Impact

This vulnerability in the Linux kernel's RAID1 implementation could potentially affect compliance with standards like GDPR or HIPAA by causing data integrity issues during write operations. If write failures are not properly handled, it may lead to incomplete or corrupted data being stored, which could violate data integrity requirements under these regulations.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to patch the vulnerability. If immediate patching is not possible, consider disabling RAID1 functionality temporarily or restricting write operations to reduce exposure until the patch is applied.

Hi! I’m here to help you understand CVE-2026-72440. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70