{"api_version":"1","generated_at":"2026-10-27T14:38:23+00:00","cve":"CVE-2026-72440","urls":{"html":"https://cve.report/CVE-2026-72440","api":"https://cve.report/api/cve/CVE-2026-72440.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72440","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72440"},"summary":{"title":"md/raid1: fix writes_pending and barrier reference leaks on write failures","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: fix writes_pending and barrier reference leaks on write failures\n\nraid1_make_request() acquires a writes_pending reference with\nmd_write_start() before calling raid1_write_request(). Several failure\npaths in raid1_write_request() complete the bio and return without\nreaching the normal write completion path, causing the corresponding\nmd_write_end() to be skipped.\n\nMake raid1_write_request() return a status indicating whether the write\nrequest was successfully queued. This allows raid1_make_request() to\ncall md_write_end() when raid1_write_request() fails.\n\nAdditionally, if wait_blocked_rdev() fails after wait_barrier()\nsucceeds, the associated barrier reference is not released.\n\nCall allow_barrier() before returning from that path to keep the barrier\naccounting balanced.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:17","updated_at":"2026-10-21 13:19:38"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","data":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/921e2baa626d1504bf30295816aaeb90ac8c82f4","name":"https://git.kernel.org/stable/c/921e2baa626d1504bf30295816aaeb90ac8c82f4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/bffbbfcbd9393e315a7a4286dcd70e875265db9a","name":"https://git.kernel.org/stable/c/bffbbfcbd9393e315a7a4286dcd70e875265db9a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a846affa813013204d0cce0cfdaeb99e8fcce188","name":"https://git.kernel.org/stable/c/a846affa813013204d0cce0cfdaeb99e8fcce188","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8e065a1602511282fc0da2dc89445e0eb71a681c","name":"https://git.kernel.org/stable/c/8e065a1602511282fc0da2dc89445e0eb71a681c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7a450460687919e79b5f8503bdeb13ecf4cca311","name":"https://git.kernel.org/stable/c/7a450460687919e79b5f8503bdeb13ecf4cca311","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72440","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72440","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca 921e2baa626d1504bf30295816aaeb90ac8c82f4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca a846affa813013204d0cce0cfdaeb99e8fcce188 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca 7a450460687919e79b5f8503bdeb13ecf4cca311 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca bffbbfcbd9393e315a7a4286dcd70e875265db9a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca 8e065a1602511282fc0da2dc89445e0eb71a681c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.17","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.160 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.114 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.57 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72440","cve":"CVE-2026-72440","epss":"0.004710000","percentile":"0.393510000","score_date":"2026-10-16","updated_at":"2026-10-17 00:14:16"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-72440","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T18:50:04.662710Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-16T18:55:24.375Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/md/raid1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"921e2baa626d1504bf30295816aaeb90ac8c82f4","status":"affected","version":"5aa705039c4fca84575539bfa2b8a28454a3d2ca","versionType":"git"},{"lessThan":"a846affa813013204d0cce0cfdaeb99e8fcce188","status":"affected","version":"5aa705039c4fca84575539bfa2b8a28454a3d2ca","versionType":"git"},{"lessThan":"7a450460687919e79b5f8503bdeb13ecf4cca311","status":"affected","version":"5aa705039c4fca84575539bfa2b8a28454a3d2ca","versionType":"git"},{"lessThan":"bffbbfcbd9393e315a7a4286dcd70e875265db9a","status":"affected","version":"5aa705039c4fca84575539bfa2b8a28454a3d2ca","versionType":"git"},{"lessThan":"8e065a1602511282fc0da2dc89445e0eb71a681c","status":"affected","version":"5aa705039c4fca84575539bfa2b8a28454a3d2ca","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/md/raid1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.160","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.114","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.57","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.17","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: fix writes_pending and barrier reference leaks on write failures\n\nraid1_make_request() acquires a writes_pending reference with\nmd_write_start() before calling raid1_write_request(). Several failure\npaths in raid1_write_request() complete the bio and return without\nreaching the normal write completion path, causing the corresponding\nmd_write_end() to be skipped.\n\nMake raid1_write_request() return a status indicating whether the write\nrequest was successfully queued. This allows raid1_make_request() to\ncall md_write_end() when raid1_write_request() fails.\n\nAdditionally, if wait_blocked_rdev() fails after wait_barrier()\nsucceeds, the associated barrier reference is not released.\n\nCall allow_barrier() before returning from that path to keep the barrier\naccounting balanced."}],"metrics":[{"cvssV3_1":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in md/raid1 write handling reached via block-layer writes to RAID1-backed volumes; on storage servers and appliances, remote NFS, SMB (ksmbd), iSCSI, and NVMe-oF clients submit those writes through md_submit_bio() to raid1_make_request() the same as local I/O.\nAC:L - An attacker with write access can reliably trigger the leaks using RWF_NOWAIT during active resync/barriers, against mirrors in BlockedBadBlocks state after prior write errors, or via bio_submit_split_bioset() failure paths; they control I/O timing and concurrency without uncontrollable races.\nPR:L - Exploitation requires only the ability to issue writes to the RAID1 array—via a mounted filesystem, O_RDWR on /dev/mdX, or an authenticated network storage client—not CAP_SYS_ADMIN or other privileges needed to create or reconfigure the md array.\nUI:N - No victim interaction is required; the attacker or their storage client issues the triggering RWF_NOWAIT or failing write requests directly, with no separate mount, file open, or administrator action needed at exploitation time.\nS:U - Impact is confined to kernel md RAID1 write/barrier accounting and array lifecycle state within the same host kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:N - Leaked writes_pending and nr_pending reference counters do not corrupt memory, read out of bounds, or use-after-free; there is no kernel pointer leak or arbitrary memory disclosure primitive.\nI:L - Skipped md_write_end() on failure paths leaves writes_pending inflated and prevents set_in_sync()/clean sysfs transitions, causing persistent incorrect RAID1 dirty/clean metadata state that cannot be corrected until reboot.\nA:H - Leaked conf->nr_pending from the wait_blocked_rdev()+REQ_NOWAIT path inflates get_unqueued_pending() so freeze_array() wait_event never completes, deadlocking array quiesce, reshape, removal, and read-error recovery while array_frozen blocks new I/O."}]}],"providerMetadata":{"dateUpdated":"2026-10-21T12:44:57.263Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/921e2baa626d1504bf30295816aaeb90ac8c82f4"},{"url":"https://git.kernel.org/stable/c/a846affa813013204d0cce0cfdaeb99e8fcce188"},{"url":"https://git.kernel.org/stable/c/7a450460687919e79b5f8503bdeb13ecf4cca311"},{"url":"https://git.kernel.org/stable/c/bffbbfcbd9393e315a7a4286dcd70e875265db9a"},{"url":"https://git.kernel.org/stable/c/8e065a1602511282fc0da2dc89445e0eb71a681c"}],"title":"md/raid1: fix writes_pending and barrier reference leaks on write failures","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72440","datePublished":"2026-08-15T05:56:52.662Z","dateReserved":"2026-08-09T03:40:39.930Z","dateUpdated":"2026-10-21T12:44:57.263Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:17","lastModifiedDate":"2026-10-21 13:19:38","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T18:50:04.662710Z","id":"CVE-2026-72440","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72440","Ordinal":"1","Title":"md/raid1: fix writes_pending and barrier reference leaks on writ","CVE":"CVE-2026-72440","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72440","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: fix writes_pending and barrier reference leaks on write failures\n\nraid1_make_request() acquires a writes_pending reference with\nmd_write_start() before calling raid1_write_request(). Several failure\npaths in raid1_write_request() complete the bio and return without\nreaching the normal write completion path, causing the corresponding\nmd_write_end() to be skipped.\n\nMake raid1_write_request() return a status indicating whether the write\nrequest was successfully queued. This allows raid1_make_request() to\ncall md_write_end() when raid1_write_request() fails.\n\nAdditionally, if wait_blocked_rdev() fails after wait_barrier()\nsucceeds, the associated barrier reference is not released.\n\nCall allow_barrier() before returning from that path to keep the barrier\naccounting balanced.","Type":"Description","Title":"md/raid1: fix writes_pending and barrier reference leaks on writ"}]}}}