Executive brief
The Linux kernel's RAID 10 storage subsystem has a memory leak in its discard (trim) operation handling. When a RAID 10 array reuses a previous read request structure for a discard operation, it fails to properly clean up replacement disk I/O buffers, causing a gradual loss of system memory. This can lead to system performance degradation and eventual unavailability on servers running storage arrays that issue frequent discard commands.
Technical details
The vulnerability is a resource management bug in the md/raid10 kernel module. The put_all_bios() function conditionally releases replacement biostructures (devs[i].repl_bio) only when r10_bio->read_slot is negative. When a discard operation reuses an r10bio data structure from a prior read request, the read_slot field retains its non-negative value, causing the conditional release check to fail and the replacement bio to leak. The fix is a single-line change: initializing r10_bio->read_slot to -1 when preparing an r10bio for discard operations in the raid10.c driver. The vulnerability affects all kernel versions with RAID 10 discard support (introduced by commit d30588b2731f) and is patched via upstream commit 6b8a26af065ddc93de2aa5c9f0df98dce9723442.
Affected products
- Linux Linux kernel all versions with RAID 10 discard support
Timeline
- 2026-05-15: other: Vulnerability fix authored
- 2026-07-24: patched: Patch committed to stable kernel branches
- 2026-08-15: disclosed: Published to NVD