{"api_version":"1","generated_at":"2026-10-27T14:38:24+00:00","cve":"CVE-2026-72438","urls":{"html":"https://cve.report/CVE-2026-72438","api":"https://cve.report/api/cve/CVE-2026-72438.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72438","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72438"},"summary":{"title":"md/raid10: fix writes_pending and barrier reference leaks on discard failures","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix writes_pending and barrier reference leaks on discard failures\n\nraid10_make_request() acquires a writes_pending reference with\nmd_write_start() before calling raid10_handle_discard(). Several failure\npaths in raid10_handle_discard() complete the bio and return without\nreleasing the corresponding reference, causing md_write_end() to be\nskipped.\n\nCall md_write_end() before returning from these failure paths to keep\nwrites_pending accounting balanced.\n\nAdditionally, discard split allocation failures can occur after\nwait_barrier() succeeds. Those paths return without calling\nallow_barrier(), leaking the associated barrier reference.\n\nRelease the barrier before returning from those paths.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:17","updated_at":"2026-10-21 13:19:37"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/80ac31cce55432034a9eb98262c92ace7866e494","name":"https://git.kernel.org/stable/c/80ac31cce55432034a9eb98262c92ace7866e494","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/11b35d1906a7277a3d64afe34224133b44327328","name":"https://git.kernel.org/stable/c/11b35d1906a7277a3d64afe34224133b44327328","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fea33968592559a55a3f5a96a6386bebcaf988a8","name":"https://git.kernel.org/stable/c/fea33968592559a55a3f5a96a6386bebcaf988a8","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d1324b41dabd26787559efaeb430643c627c1eb0","name":"https://git.kernel.org/stable/c/d1324b41dabd26787559efaeb430643c627c1eb0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/393d687131d8aa8c7e4de2cb494438e145d20fc2","name":"https://git.kernel.org/stable/c/393d687131d8aa8c7e4de2cb494438e145d20fc2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72438","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72438","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c9aa889b035fca4598ae985a0f0c76ebbb547ad2 80ac31cce55432034a9eb98262c92ace7866e494 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c9aa889b035fca4598ae985a0f0c76ebbb547ad2 fea33968592559a55a3f5a96a6386bebcaf988a8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c9aa889b035fca4598ae985a0f0c76ebbb547ad2 11b35d1906a7277a3d64afe34224133b44327328 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c9aa889b035fca4598ae985a0f0c76ebbb547ad2 d1324b41dabd26787559efaeb430643c627c1eb0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c9aa889b035fca4598ae985a0f0c76ebbb547ad2 393d687131d8aa8c7e4de2cb494438e145d20fc2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 39db562b3fedb93978a7e42dd216b306740959f8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.111 5.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.17","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.160 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.111 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.53 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72438","cve":"CVE-2026-72438","epss":"0.004600000","percentile":"0.384590000","score_date":"2026-10-16","updated_at":"2026-10-17 00:14:16"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-72438","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T18:50:00.249923Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-16T18:55:24.215Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/md/raid10.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"80ac31cce55432034a9eb98262c92ace7866e494","status":"affected","version":"c9aa889b035fca4598ae985a0f0c76ebbb547ad2","versionType":"git"},{"lessThan":"fea33968592559a55a3f5a96a6386bebcaf988a8","status":"affected","version":"c9aa889b035fca4598ae985a0f0c76ebbb547ad2","versionType":"git"},{"lessThan":"11b35d1906a7277a3d64afe34224133b44327328","status":"affected","version":"c9aa889b035fca4598ae985a0f0c76ebbb547ad2","versionType":"git"},{"lessThan":"d1324b41dabd26787559efaeb430643c627c1eb0","status":"affected","version":"c9aa889b035fca4598ae985a0f0c76ebbb547ad2","versionType":"git"},{"lessThan":"393d687131d8aa8c7e4de2cb494438e145d20fc2","status":"affected","version":"c9aa889b035fca4598ae985a0f0c76ebbb547ad2","versionType":"git"},{"status":"affected","version":"39db562b3fedb93978a7e42dd216b306740959f8","versionType":"git"},{"lessThan":"5.16","status":"affected","version":"5.15.111","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/md/raid10.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.160","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.111","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.53","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.111","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix writes_pending and barrier reference leaks on discard failures\n\nraid10_make_request() acquires a writes_pending reference with\nmd_write_start() before calling raid10_handle_discard(). Several failure\npaths in raid10_handle_discard() complete the bio and return without\nreleasing the corresponding reference, causing md_write_end() to be\nskipped.\n\nCall md_write_end() before returning from these failure paths to keep\nwrites_pending accounting balanced.\n\nAdditionally, discard split allocation failures can occur after\nwait_barrier() succeeds. Those paths return without calling\nallow_barrier(), leaking the associated barrier reference.\n\nRelease the barrier before returning from those paths."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - RAID10 is commonly used on network-facing storage servers; discard/TRIM/UNMAP from remote iSCSI initiators or NFS clients reaches raid10_make_request() through the block layer without local host login.\nAC:L - An attacker can reliably trigger the bug by issuing large, stripe-misaligned discards to force bio_split() and inducing GFP_NOIO allocation failure via self-created memory pressure; no rare timing or victim state is required.\nPR:N - Exploitation requires only network reachability to a storage service that accepts discard/UNMAP/DEALLOCATE on the RAID10 LUN or exported filesystem, not Linux host administrator privileges or capabilities.\nUI:N - Discard, TRIM, punch-hole, and SCSI UNMAP are programmatic storage operations that do not require any interactive action by a human victim beyond normal automated I/O.\nS:U - The leaked writes_pending and barrier/nr_pending counters only corrupt RAID10/md internal accounting within the kernel storage stack and do not cross VM, container, or IOMMU security boundaries.\nC:N - The flaw is reference-count leakage on writes_pending and nr_pending with no out-of-bounds access, use-after-free, or memory disclosure; no confidential data is exposed.\nI:N - No memory corruption or unauthorized modification of user or filesystem data occurs; impact is limited to incorrect internal IO/barrier accounting rather than integrity compromise.\nA:H - Leaked nr_pending prevents raise_barrier() and freeze_array() from ever completing, causing indefinite kernel thread hangs during recovery/reshape/error handling and persistent denial of storage service on the array."}]}],"providerMetadata":{"dateUpdated":"2026-10-21T12:44:55.040Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/80ac31cce55432034a9eb98262c92ace7866e494"},{"url":"https://git.kernel.org/stable/c/fea33968592559a55a3f5a96a6386bebcaf988a8"},{"url":"https://git.kernel.org/stable/c/11b35d1906a7277a3d64afe34224133b44327328"},{"url":"https://git.kernel.org/stable/c/d1324b41dabd26787559efaeb430643c627c1eb0"},{"url":"https://git.kernel.org/stable/c/393d687131d8aa8c7e4de2cb494438e145d20fc2"}],"title":"md/raid10: fix writes_pending and barrier reference leaks on discard failures","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72438","datePublished":"2026-08-15T05:56:51.384Z","dateReserved":"2026-08-09T03:40:39.929Z","dateUpdated":"2026-10-21T12:44:55.040Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:17","lastModifiedDate":"2026-10-21 13:19:37","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T18:50:00.249923Z","id":"CVE-2026-72438","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72438","Ordinal":"1","Title":"md/raid10: fix writes_pending and barrier reference leaks on dis","CVE":"CVE-2026-72438","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72438","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix writes_pending and barrier reference leaks on discard failures\n\nraid10_make_request() acquires a writes_pending reference with\nmd_write_start() before calling raid10_handle_discard(). Several failure\npaths in raid10_handle_discard() complete the bio and return without\nreleasing the corresponding reference, causing md_write_end() to be\nskipped.\n\nCall md_write_end() before returning from these failure paths to keep\nwrites_pending accounting balanced.\n\nAdditionally, discard split allocation failures can occur after\nwait_barrier() succeeds. Those paths return without calling\nallow_barrier(), leaking the associated barrier reference.\n\nRelease the barrier before returning from those paths.","Type":"Description","Title":"md/raid10: fix writes_pending and barrier reference leaks on dis"}]}}}