CVE-2026-72438

md/raid10: fix writes_pending and barrier reference leaks on discard failures

State: Published
Severity: 7.5 High
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix writes_pending and barrier reference leaks on discard failures

raid10_make_request() acquires a writes_pending reference with md_write_start() before calling raid10_handle_discard(). Several failure paths in raid10_handle_discard() complete the bio and return without releasing the corresponding reference, causing md_write_end() to be skipped.

Call md_write_end() before returning from these failure paths to keep writes_pending accounting balanced.

Additionally, discard split allocation failures can occur after wait_barrier() succeeds. Those paths return without calling allow_barrier(), leaking the associated barrier reference.

Release the barrier before returning from those paths.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before 2d264c00beadcc67f16d683ab27eed28c047ba2eAffected c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before 80ac31cce55432034a9eb98262c92ace7866e494Affected c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before fea33968592559a55a3f5a96a6386bebcaf988a8Affected c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before 11b35d1906a7277a3d64afe34224133b44327328Affected c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before d1324b41dabd26787559efaeb430643c627c1eb0Affected c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before 393d687131d8aa8c7e4de2cb494438e145d20fc2Affected 39db562b3fedb93978a7e42dd216b306740959f8Affected 5.15.111 to before 5.16Affected
LinuxLinux	5.17Affected before 5.17Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before 2d264c00beadcc67f16d683ab27eed28c047ba2eAffected
c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before 80ac31cce55432034a9eb98262c92ace7866e494Affected
c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before fea33968592559a55a3f5a96a6386bebcaf988a8Affected
c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before 11b35d1906a7277a3d64afe34224133b44327328Affected
c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before d1324b41dabd26787559efaeb430643c627c1eb0Affected
c9aa889b035fca4598ae985a0f0c76ebbb547ad2 to before 393d687131d8aa8c7e4de2cb494438e145d20fc2Affected
39db562b3fedb93978a7e42dd216b306740959f8Affected
5.15.111 to before 5.16Affected

LinuxLinux

5.17Affected
before 5.17Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.