Executive brief
The Linux kernel's RAID1 disk mirroring driver contains a resource management bug where failed write operations do not properly clean up internal reference counts. When write requests fail in certain error paths, the kernel fails to release accounting references (writes_pending and barrier references), causing resource exhaustion. This can lead to deadlocks, system hangs, or denial of service on systems using RAID1 storage.
Technical details
The vulnerability exists in the raid1_write_request() function in drivers/md/raid1.c. When write requests fail, several error paths call bio_wouldblock_error() and return without executing the normal completion path, causing md_write_end() to be skipped and writes_pending references to leak. Additionally, if wait_blocked_rdev() fails after wait_barrier() succeeds, the associated barrier reference is not released via allow_barrier(), creating additional reference leaks. The fix changes raid1_write_request() to return a boolean status indicating success, allowing raid1_make_request() to detect failures and properly call md_write_end(). It also adds allow_barrier() calls before error returns to balance barrier accounting. The vulnerability requires a failing write operation on a RAID1 device and affects code paths introduced in commits b1a7ad8b5c4f, f2a38abf5f1c, and 5aa705039c4f.
Affected products
- Linux Linux kernel Multiple versions (fix applied across 2.6.11 through 6.x and 7.x branches)
Timeline
- 2026-08-15: disclosed
- 2026-06-21: patched: Upstream fix commit 8e065a1602511282fc0da2dc89445e0eb71a681c