CVE-2026-74376

md/raid10: reset read_slot when reusing r10bio for discard

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: reset read_slot when reusing r10bio for discard

put_all_bios() always drops devs[i].bio, but it only drops devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an r10bio that was previously used for a read, read_slot can still be non-negative, and discard cleanup can skip bio_put() on repl_bio.

Reset read_slot to -1 when preparing an r10bio for discard so the replacement bio is always released correctly.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d30588b2731fb01e1616cf16c3fe79a1443e29aa to before 3cb2a606ce4902eceabe68338df0653312f861f8Affected d30588b2731fb01e1616cf16c3fe79a1443e29aa to before 561c9711e4f545d6464a023168bdee03b00fa945Affected d30588b2731fb01e1616cf16c3fe79a1443e29aa to before ce3030e92f14362880055de5fe3c258971118853Affected d30588b2731fb01e1616cf16c3fe79a1443e29aa to before 742e4afd247d9c972695227716b03d432a7e1d26Affected d30588b2731fb01e1616cf16c3fe79a1443e29aa to before b7313f23ea5a79b199a007bfad64a866cc2c22e7Affected d30588b2731fb01e1616cf16c3fe79a1443e29aa to before eb04e3e9c14ed15914f5fd2eae8b6435f54f095fAffected d30588b2731fb01e1616cf16c3fe79a1443e29aa to before 6b8a26af065ddc93de2aa5c9f0df98dce9723442Affected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

d30588b2731fb01e1616cf16c3fe79a1443e29aa to before 3cb2a606ce4902eceabe68338df0653312f861f8Affected
d30588b2731fb01e1616cf16c3fe79a1443e29aa to before 561c9711e4f545d6464a023168bdee03b00fa945Affected
d30588b2731fb01e1616cf16c3fe79a1443e29aa to before ce3030e92f14362880055de5fe3c258971118853Affected
d30588b2731fb01e1616cf16c3fe79a1443e29aa to before 742e4afd247d9c972695227716b03d432a7e1d26Affected
d30588b2731fb01e1616cf16c3fe79a1443e29aa to before b7313f23ea5a79b199a007bfad64a866cc2c22e7Affected
d30588b2731fb01e1616cf16c3fe79a1443e29aa to before eb04e3e9c14ed15914f5fd2eae8b6435f54f095fAffected
d30588b2731fb01e1616cf16c3fe79a1443e29aa to before 6b8a26af065ddc93de2aa5c9f0df98dce9723442Affected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.