CVE-2026-72440

md/raid1: fix writes_pending and barrier reference leaks on write failures

State: Published
Severity: 7.1 High
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: fix writes_pending and barrier reference leaks on write failures

raid1_make_request() acquires a writes_pending reference with md_write_start() before calling raid1_write_request(). Several failure paths in raid1_write_request() complete the bio and return without reaching the normal write completion path, causing the corresponding md_write_end() to be skipped.

Make raid1_write_request() return a status indicating whether the write request was successfully queued. This allows raid1_make_request() to call md_write_end() when raid1_write_request() fails.

Additionally, if wait_blocked_rdev() fails after wait_barrier() succeeds, the associated barrier reference is not released.

Call allow_barrier() before returning from that path to keep the barrier accounting balanced.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5aa705039c4fca84575539bfa2b8a28454a3d2ca to before 874f54243d881fde1890849000beb88a7880d1ecAffected 5aa705039c4fca84575539bfa2b8a28454a3d2ca to before 921e2baa626d1504bf30295816aaeb90ac8c82f4Affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca to before a846affa813013204d0cce0cfdaeb99e8fcce188Affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca to before 7a450460687919e79b5f8503bdeb13ecf4cca311Affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca to before bffbbfcbd9393e315a7a4286dcd70e875265db9aAffected 5aa705039c4fca84575539bfa2b8a28454a3d2ca to before 8e065a1602511282fc0da2dc89445e0eb71a681cAffected
LinuxLinux	5.17Affected before 5.17Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

5aa705039c4fca84575539bfa2b8a28454a3d2ca to before 874f54243d881fde1890849000beb88a7880d1ecAffected
5aa705039c4fca84575539bfa2b8a28454a3d2ca to before 921e2baa626d1504bf30295816aaeb90ac8c82f4Affected
5aa705039c4fca84575539bfa2b8a28454a3d2ca to before a846affa813013204d0cce0cfdaeb99e8fcce188Affected
5aa705039c4fca84575539bfa2b8a28454a3d2ca to before 7a450460687919e79b5f8503bdeb13ecf4cca311Affected
5aa705039c4fca84575539bfa2b8a28454a3d2ca to before bffbbfcbd9393e315a7a4286dcd70e875265db9aAffected
5aa705039c4fca84575539bfa2b8a28454a3d2ca to before 8e065a1602511282fc0da2dc89445e0eb71a681cAffected

LinuxLinux

5.17Affected
before 5.17Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.