CVE-2026-74372

In the Linux kernel, the following vulnerability has been resolved: raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path In raid1_write_request(), each per-mirror loop iteration begins by incrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a badblock within the requested range, the code jumps to err_handle without dropping the reference taken for the current mirror. err_handle's cleanup loop will only decrements for k < i and r1_bio->bios[k] is non-NULL. The current slot is therefore skipped, leaving its nr_pending reference leaked permanently. The reference prevents the rdev from ever being removed, since raid1_remove_conf() refuses to remove an rdev with nr_pending > 0. Fix this by calling rdev_dec_pending() before jumping to err_handle.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/5ac9e793ba2583d72740d929e7858a6c82e22ed5
https://git.kernel.org/stable/c/731485617bf862f1289c3f40ed1f800d0475826f
https://git.kernel.org/stable/c/909d9dc3b5730c8ed7b764c68bc788342df2a07b

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-15 06:22

Updated : 2026-08-17 06:19

NVD link : CVE-2026-74372

Mitre link : CVE-2026-74372

CVE.ORG link : CVE-2026-74372

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74372", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f2a38abf5f1c5aeb3be8e9f4d3d815c867fff7ca", "lessThan": "5ac9e793ba2583d72740d929e7858a6c82e22ed5", "versionType": "git"}, {"status": "affected", "version": "f2a38abf5f1c5aeb3be8e9f4d3d815c867fff7ca", "lessThan": "731485617bf862f1289c3f40ed1f800d0475826f", "versionType": "git"}, {"status": "affected", "version": "f2a38abf5f1c5aeb3be8e9f4d3d815c867fff7ca", "lessThan": "909d9dc3b5730c8ed7b764c68bc788342df2a07b", "versionType": "git"}], "programFiles": ["drivers/md/raid1.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"status": "unaffected", "version": "0", "lessThan": "6.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/md/raid1.c"], "defaultStatus": "affected"}]}], "published": "2026-08-15T06:22:38.967", "references": [{"url": "https://git.kernel.org/stable/c/5ac9e793ba2583d72740d929e7858a6c82e22ed5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/731485617bf862f1289c3f40ed1f800d0475826f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/909d9dc3b5730c8ed7b764c68bc788342df2a07b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nraid1: fix nr_pending leak in REQ_ATOMIC bad-block error path\n\nIn raid1_write_request(), each per-mirror loop iteration begins by\nincrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a\nbadblock within the requested range, the code jumps to err_handle\nwithout dropping the reference taken for the current mirror.\n\nerr_handle's cleanup loop will only decrements for k < i and\nr1_bio->bios[k] is non-NULL. The current slot is therefore skipped,\nleaving its nr_pending reference leaked permanently. The reference\nprevents the rdev from ever being removed, since raid1_remove_conf()\nrefuses to remove an rdev with nr_pending > 0.\n\nFix this by calling rdev_dec_pending() before jumping to err_handle."}], "lastModified": "2026-08-17T06:19:32.023", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}