CVE-2026-74376md/raid10: reset read_slot when reusing r10bio for discard
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read_slot when reusing r10bio for discard put_all_bios() always drops devs[i].bio, but it only drops devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an r10bio that was previously used for a read, read_slot can still be non-negative, and discard cleanup can skip bio_put() on repl_bio. Reset read_slot to -1 when preparing an r10bio for discard so the replacement bio is always released correctly.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d30588b2731fb01e1616cf16c3fe79a1443e29aa before 3cb2a606ce4902eceabe68338df0653312f861f8; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before 561c9711e4f545d6464a023168bdee03b00fa945; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before ce3030e92f14362880055de5fe3c258971118853; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before 742e4afd247d9c972695227716b03d432a7e1d26; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before b7313f23ea5a79b199a007bfad64a866cc2c22e7; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before eb04e3e9c14ed15914f5fd2eae8b6435f54f095f; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before 6b8a26af065ddc93de2aa5c9f0df98dce9723442 | CNA record |
References
- https://git.kernel.org/stable/c/3cb2a606ce4902eceabe68338df0653312f861f8
- https://git.kernel.org/stable/c/561c9711e4f545d6464a023168bdee03b00fa945
- https://git.kernel.org/stable/c/ce3030e92f14362880055de5fe3c258971118853
- https://git.kernel.org/stable/c/742e4afd247d9c972695227716b03d432a7e1d26
- https://git.kernel.org/stable/c/b7313f23ea5a79b199a007bfad64a866cc2c22e7
- https://git.kernel.org/stable/c/eb04e3e9c14ed15914f5fd2eae8b6435f54f095f
- https://git.kernel.org/stable/c/6b8a26af065ddc93de2aa5c9f0df98dce9723442
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.