Executive brief
The Linux kernel's RAID10 storage subsystem has a resource leak where failed write requests do not properly release a reference counter (writes_pending). This causes the storage system to hang when waiting for pending writes to complete, potentially blocking I/O operations and affecting system availability.
Technical details
The vulnerability is a resource leak in the md/raid10 driver where raid10_write_request() can complete a bio and return without properly releasing the writes_pending reference acquired by md_write_start(). The root cause is that several error paths in raid10_write_request() bypass the normal write completion path, skipping the corresponding md_write_end() call. The fix changes raid10_write_request() to return a boolean status indicating success or failure, allowing raid10_make_request() to call md_write_end() when a write request fails. This is a kernel-internal bug affecting the RAID10 storage driver, exploitable only through specific write request failure conditions.
Affected products
- Linux Linux kernel multiple versions (fix applies across 4.0 through 7.2 stable branches)
Timeline
- 2026-08-15: disclosed: Published to NVD
- 2026-06-21: patched: Upstream fix merged by Yu Kuai
- 2026-07-24: patched: Backported to stable kernels by Greg Kroah-Hartman