CVE-2026-74372raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path In raid1_write_request(), each per-mirror loop iteration begins by incrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a badblock within the requested range, the code jumps to err_handle without dropping the reference taken for the current mirror. err_handle's cleanup loop will only decrements for k < i and r1_bio->bios[k] is non-NULL. The current slot is therefore skipped, leaving its nr_pending reference leaked permanently. The reference prevents the rdev from ever being removed, since raid1_remove_conf() refuses to remove an rdev with nr_pending > 0. Fix this by calling rdev_dec_pending() before jumping to err_handle.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f2a38abf5f1c5aeb3be8e9f4d3d815c867fff7ca before 5ac9e793ba2583d72740d929e7858a6c82e22ed5; from f2a38abf5f1c5aeb3be8e9f4d3d815c867fff7ca before 731485617bf862f1289c3f40ed1f800d0475826f; from f2a38abf5f1c5aeb3be8e9f4d3d815c867fff7ca before 909d9dc3b5730c8ed7b764c68bc788342df2a07b | CNA record |
References
- https://git.kernel.org/stable/c/5ac9e793ba2583d72740d929e7858a6c82e22ed5
- https://git.kernel.org/stable/c/731485617bf862f1289c3f40ed1f800d0475826f
- https://git.kernel.org/stable/c/909d9dc3b5730c8ed7b764c68bc788342df2a07b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.