CVE-2026-72437md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry When a read is retried, raid1_read_request() may be called with a pre-allocated r1_bio. If wait_read_barrier() fails for a REQ_NOWAIT read, the bio is completed and the function returns immediately. In this case the existing r1_bio is leaked. This fixes a leak of pre-allocated r1_bio structures for retried reads.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5aa705039c4fca84575539bfa2b8a28454a3d2ca before d1eda529a4bf6b866d02755723ee0eb1f037a5ed; from 5aa705039c4fca84575539bfa2b8a28454a3d2ca before c66ed3e6371f5dba8f5d8ab810d6683ddc99201e; from 5aa705039c4fca84575539bfa2b8a28454a3d2ca before db58075bc9c2ad2731f9c063859b47104bc2e7ef; from 5aa705039c4fca84575539bfa2b8a28454a3d2ca before 6d92dbd73d19a0622f60352ce9d9379f7a760112; from 5aa705039c4fca84575539bfa2b8a28454a3d2ca before c6e6354295845698d2fdfa20b71fc404786f7e93; from 5aa705039c4fca84575539bfa2b8a28454a3d2ca before 69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12 | CNA record |
References
- https://git.kernel.org/stable/c/d1eda529a4bf6b866d02755723ee0eb1f037a5ed
- https://git.kernel.org/stable/c/c66ed3e6371f5dba8f5d8ab810d6683ddc99201e
- https://git.kernel.org/stable/c/db58075bc9c2ad2731f9c063859b47104bc2e7ef
- https://git.kernel.org/stable/c/6d92dbd73d19a0622f60352ce9d9379f7a760112
- https://git.kernel.org/stable/c/c6e6354295845698d2fdfa20b71fc404786f7e93
- https://git.kernel.org/stable/c/69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.