CVE-2026-72439 md/raid10: fix writes_pending leak on write request failures
A resource leak in the Linux kernel RAID10 driver can cause a denial of service when write requests fail.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72439?
CVE-2026-72439 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: fix writes_pending leak on write request failures
raid10_make_request() acquires a writes_pending reference with md_write_start() before dispatching write requests. Several failure paths in raid10_write_request() complete the bio and return without reaching the normal write completion path, causing the corresponding md_write_end() to be skipped.
Make raid10_write_request() return a status indicating whether the write request was successfully queued. This allows raid10_make_request() to release the writes_pending reference with md_write_end() when a write request fails.
Which versions are affected by CVE-2026-72439?
How do I fix CVE-2026-72439?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-72439 being exploited?
There is no known exploitation of CVE-2026-72439 in the wild and no public exploit code.
Sources
Also known as AZL-96398, BELL-CVE-2026-72439, DEBIAN-CVE-2026-72439, GHSA-xqj6-523w-5f3g, UBUNTU-CVE-2026-72439.