Junglewise Threat Intelligence

CVE-2026-74372: Linux kernel raid1 nr_pending reference leak in REQ_ATOMIC error path

CVE-2026-74372 · Severity: info · Published 2026-08-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's RAID 1 disk mirroring driver contains a reference-counting bug in its atomic write error handling. When an atomic write encounters a bad sector, a device reference is not properly released, preventing that storage device from ever being removed from the system. This is a resource leak that does not directly impact data integrity but can prevent normal device management operations.

Technical details

The vulnerability is a reference leak in raid1_write_request() in drivers/md/raid1.c. When handling REQ_ATOMIC (atomic/uring) write requests that encounter badblocks, the code jumps to err_handle without calling rdev_dec_pending() to release the reference taken at the start of the per-mirror loop iteration. The cleanup loop in err_handle only processes mirrors k < i, skipping the current mirror and leaving its nr_pending count permanently elevated. Since raid1_remove_conf() refuses to remove devices with nr_pending > 0, this prevents device removal. The fix is a simple addition of rdev_dec_pending() before the goto err_handle statement. Patches have been applied to stable kernel branches.

Affected products

  • Linux Linux kernel 5.16 and later (specific versions not fully enumerated, but multiple stable branches affected)

Timeline

  • 2026-08-15: disclosed: Published on NVD
  • 2026-05-30: patched: Upstream fix committed by Abd-Alrhman Masalkhi

References

Related threats