CVE-2026-74373

Received Received - Intake

Linux Kernel md/raid1 and raid10 Bio Accounting Vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix bio accounting for split md cloned bios Use md_cloned_bio() to control bio accounting instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10. The previous logic does not reliably reflect whether a bio is an md cloned bio. When a failed bio is split and resubmitted via bio_submit_split_bioset() on the error path, this can lead to either double accounting for md cloned bios, or missing accounting for bios returned from bio_submit_split_bioset() Fix this by using md_cloned_bio() to detect md cloned bios and skip accounting accordingly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74373

EUVD

EUVD-2026-59520

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect accounting of cloned bios in RAID1 and RAID10 configurations. When a failed bio is split and resubmitted, the system may either double-count or miss counting these bios, leading to accounting errors.

Detection Guidance

This vulnerability is specific to the Linux kernel's md/raid1 and raid10 subsystems. Detection requires checking kernel logs for bio accounting errors or crashes related to RAID operations. Monitor dmesg or journalctl for errors like 'bio accounting mismatch' or 'md cloned bio accounting failure'.

Impact Analysis

This flaw could cause data corruption or system instability in systems using RAID1 or RAID10 setups. It may lead to incorrect resource tracking, potentially causing crashes or performance issues.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue related to bio accounting in RAID configurations, which does not involve data privacy, security controls, or regulatory requirements.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the md/raid1 and raid10 bio accounting flaw. If immediate patching is not possible, avoid using RAID1 or RAID10 configurations until the update is applied to prevent potential data corruption or system instability.

Hi! I’m here to help you understand CVE-2026-74373. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70