Executive brief
The Linux kernel's RAID10 storage driver has a reference counting bug that causes write and barrier references to leak when handling discard (data erasure) operations that fail. This can lead to deadlocks or system hangs because the write and I/O barrier accounting becomes imbalanced, preventing the driver from properly tracking and completing pending I/O operations.
Technical details
The vulnerability is a reference leak in raid10_handle_discard() in the md/raid10 driver. The function acquires writes_pending and barrier references in the caller (raid10_make_request()), but several error paths complete the bio and return without releasing these references. Specifically, when wait_barrier() fails or when bio_split() allocation fails after wait_barrier() succeeds, the code returns without calling md_write_end() or allow_barrier(), causing accounting imbalance. This is a local kernel bug requiring no network attack vector or user interaction, affecting systems using RAID10 configurations. The fix adds md_write_end() and allow_barrier() calls to the affected error paths. Patches are available in upstream Linux and stable releases.
Affected products
- Linux Linux kernel multiple versions (patch backported across 2.6.11 through 7.2)
Timeline
- 2026-08-15: disclosed: Published via NVD
- 2026-06-13: patched: Original fix committed upstream (commit 393d687131d8aa8c7e4de2cb494438e145d20fc2)
- 2026-09-21: advisory: Patch backported to stable releases