Executive brief
The Linux kernel's RAID 1 disk mirroring driver contains a reference-counting bug in its atomic write error handling. When an atomic write encounters a bad sector, a device reference is not properly released, preventing that storage device from ever being removed from the system. This is a resource leak that does not directly impact data integrity but can prevent normal device management operations.
Technical details
The vulnerability is a reference leak in raid1_write_request() in drivers/md/raid1.c. When handling REQ_ATOMIC (atomic/uring) write requests that encounter badblocks, the code jumps to err_handle without calling rdev_dec_pending() to release the reference taken at the start of the per-mirror loop iteration. The cleanup loop in err_handle only processes mirrors k < i, skipping the current mirror and leaving its nr_pending count permanently elevated. Since raid1_remove_conf() refuses to remove devices with nr_pending > 0, this prevents device removal. The fix is a simple addition of rdev_dec_pending() before the goto err_handle statement. Patches have been applied to stable kernel branches.
Affected products
- Linux Linux kernel 5.16 and later (specific versions not fully enumerated, but multiple stable branches affected)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-05-30: patched: Upstream fix committed by Abd-Alrhman Masalkhi