CVE-2026-74376 (GCVE-0-2026-74376)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:46
VLAI
Title
md/raid10: reset read_slot when reusing r10bio for discard
Summary
In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read_slot when reusing r10bio for discard put_all_bios() always drops devs[i].bio, but it only drops devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an r10bio that was previously used for a read, read_slot can still be non-negative, and discard cleanup can skip bio_put() on repl_bio. Reset read_slot to -1 when preparing an r10bio for discard so the replacement bio is always released correctly.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d30588b2731fb01e1616cf16c3fe79a1443e29aa , < 3cb2a606ce4902eceabe68338df0653312f861f8 (git)
Affected: d30588b2731fb01e1616cf16c3fe79a1443e29aa , < 561c9711e4f545d6464a023168bdee03b00fa945 (git)
Affected: d30588b2731fb01e1616cf16c3fe79a1443e29aa , < ce3030e92f14362880055de5fe3c258971118853 (git)
Affected: d30588b2731fb01e1616cf16c3fe79a1443e29aa , < 742e4afd247d9c972695227716b03d432a7e1d26 (git)
Affected: d30588b2731fb01e1616cf16c3fe79a1443e29aa , < b7313f23ea5a79b199a007bfad64a866cc2c22e7 (git)
Affected: d30588b2731fb01e1616cf16c3fe79a1443e29aa , < eb04e3e9c14ed15914f5fd2eae8b6435f54f095f (git)
Affected: d30588b2731fb01e1616cf16c3fe79a1443e29aa , < 6b8a26af065ddc93de2aa5c9f0df98dce9723442 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3cb2a606ce4902eceabe68338df0653312f861f8",
              "status": "affected",
              "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
              "versionType": "git"
            },
            {
              "lessThan": "561c9711e4f545d6464a023168bdee03b00fa945",
              "status": "affected",
              "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
              "versionType": "git"
            },
            {
              "lessThan": "ce3030e92f14362880055de5fe3c258971118853",
              "status": "affected",
              "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
              "versionType": "git"
            },
            {
              "lessThan": "742e4afd247d9c972695227716b03d432a7e1d26",
              "status": "affected",
              "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
              "versionType": "git"
            },
            {
              "lessThan": "b7313f23ea5a79b199a007bfad64a866cc2c22e7",
              "status": "affected",
              "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
              "versionType": "git"
            },
            {
              "lessThan": "eb04e3e9c14ed15914f5fd2eae8b6435f54f095f",
              "status": "affected",
              "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
              "versionType": "git"
            },
            {
              "lessThan": "6b8a26af065ddc93de2aa5c9f0df98dce9723442",
              "status": "affected",
              "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: reset read_slot when reusing r10bio for discard\n\nput_all_bios() always drops devs[i].bio, but it only drops\ndevs[i].repl_bio when r10_bio-\u003eread_slot \u003c 0. If discard reuses an\nr10bio that was previously used for a read, read_slot can still be\nnon-negative, and discard cleanup can skip bio_put() on repl_bio.\n\nReset read_slot to -1 when preparing an r10bio for discard so the\nreplacement bio is always released correctly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - iSCSI/NVMe-oF targets and appliances commonly expose RAID10-backed LUNs; remote SCSI UNMAP maps through target_core iblock_execute_unmap()/blkdev_issue_discard() to md_handle_request() and raid10_handle_discard without local access.\nAC:L - The attacker controls both pool poisoning reads and triggering discards; mempool-reused r10bios retain a non-negative read_slot from prior reads, so each qualifying discard reliably skips repl_bio bio_put() when replacement mirrors exist.\nPR:N - Network UNMAP from an iSCSI/NVMe-oF client needs no Linux UID or capabilities on the target; local exploitation only needs O_RDWR on the md device or FITRIM (CAP_SYS_ADMIN, obtainable in user namespaces), both below High.\nUI:N - No interactive victim action\u2014exploitation uses normal block-layer discard requests (fstrim cron, UNMAP, BLKDISCARD) issued or scripted by the attacker without cooperation.\nS:U - The bug corrupts/leaks kernel bio objects within the same host kernel security domain; it does not cross VM, container, or IOMMU boundaries.\nC:H - Stale read_slot misclassifies repl_bio as rdev in the r10dev union during put_all_bios(), leaking live bios holding kernel pointers and enabling heap-grooming read primitives; scored High when uncertain per memory-corruption guidance.\nI:H - The read_slot/repl_bio union type confusion skips bio_put() on attacker-submitted replacement discard clones, enabling slab manipulation for arbitrary kernel writes; type confusion maps to High integrity impact per kernel CVSS guidance.\nA:H - Repeated read-then-discard cycles leak bios on every hit; on busy RAID10 storage servers this exhausts kmem and can trigger OOM killer or panic, so Availability is High rather than Low per the conservative rule."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:28.657Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3cb2a606ce4902eceabe68338df0653312f861f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/561c9711e4f545d6464a023168bdee03b00fa945"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce3030e92f14362880055de5fe3c258971118853"
        },
        {
          "url": "https://git.kernel.org/stable/c/742e4afd247d9c972695227716b03d432a7e1d26"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7313f23ea5a79b199a007bfad64a866cc2c22e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb04e3e9c14ed15914f5fd2eae8b6435f54f095f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b8a26af065ddc93de2aa5c9f0df98dce9723442"
        }
      ],
      "title": "md/raid10: reset read_slot when reusing r10bio for discard",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74376",
    "datePublished": "2026-08-15T05:58:55.023Z",
    "dateReserved": "2026-08-15T05:44:03.889Z",
    "dateUpdated": "2026-08-17T05:46:28.657Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74376",
      "date": "2026-09-21",
      "epss": "0.00502",
      "percentile": "0.41848"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/raid10.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3cb2a606ce4902eceabe68338df0653312f861f8",
                    "status": "affected",
                    "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "561c9711e4f545d6464a023168bdee03b00fa945",
                    "status": "affected",
                    "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ce3030e92f14362880055de5fe3c258971118853",
                    "status": "affected",
                    "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "742e4afd247d9c972695227716b03d432a7e1d26",
                    "status": "affected",
                    "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b7313f23ea5a79b199a007bfad64a866cc2c22e7",
                    "status": "affected",
                    "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eb04e3e9c14ed15914f5fd2eae8b6435f54f095f",
                    "status": "affected",
                    "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6b8a26af065ddc93de2aa5c9f0df98dce9723442",
                    "status": "affected",
                    "version": "d30588b2731fb01e1616cf16c3fe79a1443e29aa",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/raid10.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.13"
                  },
                  {
                    "lessThan": "5.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: reset read_slot when reusing r10bio for discard\n\nput_all_bios() always drops devs[i].bio, but it only drops\ndevs[i].repl_bio when r10_bio-\u003eread_slot \u003c 0. If discard reuses an\nr10bio that was previously used for a read, read_slot can still be\nnon-negative, and discard cleanup can skip bio_put() on repl_bio.\n\nReset read_slot to -1 when preparing an r10bio for discard so the\nreplacement bio is always released correctly."
          }
        ],
        "id": "CVE-2026-74376",
        "lastModified": "2026-08-17T06:19:32.373",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:39.373",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3cb2a606ce4902eceabe68338df0653312f861f8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/561c9711e4f545d6464a023168bdee03b00fa945"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6b8a26af065ddc93de2aa5c9f0df98dce9723442"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/742e4afd247d9c972695227716b03d432a7e1d26"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b7313f23ea5a79b199a007bfad64a866cc2c22e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ce3030e92f14362880055de5fe3c258971118853"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eb04e3e9c14ed15914f5fd2eae8b6435f54f095f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T12:44:59+00:00",
      "cve": "CVE-2026-74376",
      "id": "CVE-2026-74376",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: md/raid10: reset read_slot when reusing r10bio for discard",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74376.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:22:02Z",
      "cve": "CVE-2026-74376",
      "id": "CVE-2026-74376",
      "initial_release_date": "2026-08-29T01:08:28Z",
      "product_status:known_affected": "245",
      "product_status:known_not_affected": "117",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74376",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74376.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.