CVE-2026-74372 raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path
A reference leak in the Linux kernel RAID1 driver prevents disk removal, leading to a denial of service condition for local attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74372?
CVE-2026-74372 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path
In raid1_write_request(), each per-mirror loop iteration begins by incrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a badblock within the requested range, the code jumps to err_handle without dropping the reference taken for the current mirror.
err_handle's cleanup loop will only decrements for k < i and r1_bio->bios[k] is non-NULL. The current slot is therefore skipped, leaving its nr_pending reference leaked permanently. The reference prevents the rdev from ever being removed, since raid1_remove_conf() refuses to remove an rdev with nr_pending > 0.
Fix this by calling rdev_dec_pending() before jumping to err_handle.
Which versions are affected by CVE-2026-74372?
How do I fix CVE-2026-74372?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74372 being exploited?
There is no known exploitation of CVE-2026-74372 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74372, DEBIAN-CVE-2026-74372, GHSA-g6g3-325w-fc52, UBUNTU-CVE-2026-74372.