CVE-2026-72440 (GCVE-0-2026-72440)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:56 – Updated: 2026-08-17 05:44
VLAI
Title
md/raid1: fix writes_pending and barrier reference leaks on write failures
Summary
In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writes_pending and barrier reference leaks on write failures raid1_make_request() acquires a writes_pending reference with md_write_start() before calling raid1_write_request(). Several failure paths in raid1_write_request() complete the bio and return without reaching the normal write completion path, causing the corresponding md_write_end() to be skipped. Make raid1_write_request() return a status indicating whether the write request was successfully queued. This allows raid1_make_request() to call md_write_end() when raid1_write_request() fails. Additionally, if wait_blocked_rdev() fails after wait_barrier() succeeds, the associated barrier reference is not released. Call allow_barrier() before returning from that path to keep the barrier accounting balanced.
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5aa705039c4fca84575539bfa2b8a28454a3d2ca , < bffbbfcbd9393e315a7a4286dcd70e875265db9a (git)
Affected: 5aa705039c4fca84575539bfa2b8a28454a3d2ca , < 8e065a1602511282fc0da2dc89445e0eb71a681c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bffbbfcbd9393e315a7a4286dcd70e875265db9a",
              "status": "affected",
              "version": "5aa705039c4fca84575539bfa2b8a28454a3d2ca",
              "versionType": "git"
            },
            {
              "lessThan": "8e065a1602511282fc0da2dc89445e0eb71a681c",
              "status": "affected",
              "version": "5aa705039c4fca84575539bfa2b8a28454a3d2ca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: fix writes_pending and barrier reference leaks on write failures\n\nraid1_make_request() acquires a writes_pending reference with\nmd_write_start() before calling raid1_write_request(). Several failure\npaths in raid1_write_request() complete the bio and return without\nreaching the normal write completion path, causing the corresponding\nmd_write_end() to be skipped.\n\nMake raid1_write_request() return a status indicating whether the write\nrequest was successfully queued. This allows raid1_make_request() to\ncall md_write_end() when raid1_write_request() fails.\n\nAdditionally, if wait_blocked_rdev() fails after wait_barrier()\nsucceeds, the associated barrier reference is not released.\n\nCall allow_barrier() before returning from that path to keep the barrier\naccounting balanced."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in md/raid1 write handling reached via block-layer writes to RAID1-backed volumes; on storage servers and appliances, remote NFS, SMB (ksmbd), iSCSI, and NVMe-oF clients submit those writes through md_submit_bio() to raid1_make_request() the same as local I/O.\nAC:L - An attacker with write access can reliably trigger the leaks using RWF_NOWAIT during active resync/barriers, against mirrors in BlockedBadBlocks state after prior write errors, or via bio_submit_split_bioset() failure paths; they control I/O timing and concurrency without uncontrollable races.\nPR:L - Exploitation requires only the ability to issue writes to the RAID1 array\u2014via a mounted filesystem, O_RDWR on /dev/mdX, or an authenticated network storage client\u2014not CAP_SYS_ADMIN or other privileges needed to create or reconfigure the md array.\nUI:N - No victim interaction is required; the attacker or their storage client issues the triggering RWF_NOWAIT or failing write requests directly, with no separate mount, file open, or administrator action needed at exploitation time.\nS:U - Impact is confined to kernel md RAID1 write/barrier accounting and array lifecycle state within the same host kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:N - Leaked writes_pending and nr_pending reference counters do not corrupt memory, read out of bounds, or use-after-free; there is no kernel pointer leak or arbitrary memory disclosure primitive.\nI:L - Skipped md_write_end() on failure paths leaves writes_pending inflated and prevents set_in_sync()/clean sysfs transitions, causing persistent incorrect RAID1 dirty/clean metadata state that cannot be corrected until reboot.\nA:H - Leaked conf-\u003enr_pending from the wait_blocked_rdev()+REQ_NOWAIT path inflates get_unqueued_pending() so freeze_array() wait_event never completes, deadlocking array quiesce, reshape, removal, and read-error recovery while array_frozen blocks new I/O."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:14.243Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bffbbfcbd9393e315a7a4286dcd70e875265db9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e065a1602511282fc0da2dc89445e0eb71a681c"
        }
      ],
      "title": "md/raid1: fix writes_pending and barrier reference leaks on write failures",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72440",
    "datePublished": "2026-08-15T05:56:52.662Z",
    "dateReserved": "2026-08-09T03:40:39.930Z",
    "dateUpdated": "2026-08-17T05:44:14.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72440",
      "date": "2026-09-21",
      "epss": "0.00364",
      "percentile": "0.30124"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:44:05.000Z",
      "cve": "CVE-2026-72440",
      "id": "msrc_CVE-2026-72440",
      "initial_release_date": "2026-08-23T14:44:05.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "md/raid1: fix writes_pending and barrier reference leaks on write failures",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72440.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/raid1.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bffbbfcbd9393e315a7a4286dcd70e875265db9a",
                    "status": "affected",
                    "version": "5aa705039c4fca84575539bfa2b8a28454a3d2ca",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8e065a1602511282fc0da2dc89445e0eb71a681c",
                    "status": "affected",
                    "version": "5aa705039c4fca84575539bfa2b8a28454a3d2ca",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/raid1.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.17"
                  },
                  {
                    "lessThan": "5.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: fix writes_pending and barrier reference leaks on write failures\n\nraid1_make_request() acquires a writes_pending reference with\nmd_write_start() before calling raid1_write_request(). Several failure\npaths in raid1_write_request() complete the bio and return without\nreaching the normal write completion path, causing the corresponding\nmd_write_end() to be skipped.\n\nMake raid1_write_request() return a status indicating whether the write\nrequest was successfully queued. This allows raid1_make_request() to\ncall md_write_end() when raid1_write_request() fails.\n\nAdditionally, if wait_blocked_rdev() fails after wait_barrier()\nsucceeds, the associated barrier reference is not released.\n\nCall allow_barrier() before returning from that path to keep the barrier\naccounting balanced."
          }
        ],
        "id": "CVE-2026-72440",
        "lastModified": "2026-08-17T06:19:11.367",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:17.843",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8e065a1602511282fc0da2dc89445e0eb71a681c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bffbbfcbd9393e315a7a4286dcd70e875265db9a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T07:27:32+00:00",
      "cve": "CVE-2026-72440",
      "id": "CVE-2026-72440",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: md/raid1: fix writes_pending and barrier reference leaks on write failures",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72440.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:25:43Z",
      "cve": "CVE-2026-72440",
      "id": "CVE-2026-72440",
      "initial_release_date": "2026-08-27T16:52:37Z",
      "product_status:known_affected": "177",
      "product_status:known_not_affected": "185",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72440",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72440.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.