CVE-2026-74372

Received Received - Intake

Memory Leak in Linux Kernel RAID1 Implementation

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path In raid1_write_request(), each per-mirror loop iteration begins by incrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a badblock within the requested range, the code jumps to err_handle without dropping the reference taken for the current mirror. err_handle's cleanup loop will only decrements for k < i and r1_bio->bios[k] is non-NULL. The current slot is therefore skipped, leaving its nr_pending reference leaked permanently. The reference prevents the rdev from ever being removed, since raid1_remove_conf() refuses to remove an rdev with nr_pending > 0. Fix this by calling rdev_dec_pending() before jumping to err_handle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74372

EUVD

EUVD-2026-59519

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's RAID1 implementation. It involves a reference count leak where nr_pending is incremented but not properly decremented in error paths. Specifically, when a REQ_ATOMIC write encounters a bad block, the cleanup code skips decrementing the reference for the current mirror, causing a permanent leak. This prevents the affected device from being removed.

Detection Guidance

This vulnerability is specific to the Linux kernel's RAID1 implementation and does not have a direct network detection method. To detect it, check your kernel version and RAID1 configuration. Use commands like 'uname -r' to verify the kernel version and 'cat /proc/mdstat' to inspect RAID1 arrays for potential issues.

Impact Analysis

This vulnerability could lead to resource exhaustion in the RAID1 subsystem. The leaked reference count may cause the system to retain references to devices that should be removed, potentially leading to degraded performance or unexpected behavior in RAID configurations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a low-level kernel memory leak in RAID1 error handling. Compliance impacts would only occur if the vulnerability led to data corruption or unavailability, which is not described here.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor RAID1 arrays for abnormal behavior and ensure proper error handling in disk operations. If using a vulnerable kernel, avoid REQ_ATOMIC write operations on RAID1 arrays until patched.

Hi! I’m here to help you understand CVE-2026-74372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70