CVE-2026-74375

Received Received - Intake

Deadlock in Linux Kernel RAID1 and RAID10 Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix deadlock in read error recovery path raid1d and raid10d may resubmit a split md cloned bio while handling a read error. In this case, resubmitting the bio can lead to a deadlock if the array is suspended before md_handle_request() acquires an active_io reference via percpu_ref_tryget_live(). Since the cloned bio already holds an active_io reference, trying to acquire another reference via percpu_ref_tryget_live() can lead to a deadlock while the array is suspended. Fix this by using percpu_ref_get() for md cloned bios.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74375

EUVD

EUVD-2026-59522

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a deadlock in the RAID1 and RAID10 read error recovery path. When a read error occurs, the system may resubmit a cloned bio while the array is suspended, leading to a deadlock because the cloned bio already holds an active_io reference. The fix involves using percpu_ref_get() instead of percpu_ref_tryget_live() for md cloned bios.

Detection Guidance

This vulnerability is specific to the Linux kernel's RAID1 and RAID10 modules. Detection requires checking kernel logs for deadlock events in md/raid1 or raid10d processes. Monitor system logs for I/O errors or deadlock warnings during RAID operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability can cause system hangs or crashes when handling read errors in RAID1 or RAID10 arrays. If the array is suspended during error recovery, the deadlock may freeze the system, leading to data unavailability or service disruption.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue causing a deadlock in RAID1 and RAID10 read error recovery, which could lead to system instability or data unavailability but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Apply the kernel patch that fixes the deadlock in the RAID1 and RAID10 read error recovery path. Update your Linux kernel to a version that includes the fix for CVE-2026-74375. Avoid suspending RAID arrays during active I/O operations to reduce deadlock risk until patched.

Hi! I’m here to help you understand CVE-2026-74375. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70