CVE-2026-72420

A flaw was found in the Linux kernel's md/raid5 module. A data-race condition exists between the break_stripe_batch_list() and raid5_make_request() functions. This race can lead to a scenario where a process waits indefinitely, potentially causing a Denial of Service (DoS) for the system.

A moderate-impact flaw was found in the Linux kernel's md/raid5 module as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt packages) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm packages). A data race between break_stripe_batch_list() and raid5_make_request() can lead to inconsistent handling of the R5_Overlap flag on stripe devices: when a stripe batch is being broken while new I/O is submitted, a task can wait indefinitely in wait_on_bit() because the matching wake_up_bit() never occurs. This hangs the affected I/O and can degrade the RAID5 array, resulting in a local denial of service. Triggering the race requires a local user or process able to issue write I/O to a configured md/raid5 device together with precise timing; confidentiality and integrity are not affected. The Red Hat Enterprise Linux 6 stream is out of support scope and no fix is planned for it. For the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams the fix is currently deferred to a future update, so the residual risk remains a local denial of service through hung I/O on md/raid5 arrays. Red Hat rates this flaw Moderate (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVE record's 8.8 score because upstream considers the flaw network-reachable with confidentiality and integrity impact, whereas exploitation requires local access to a configured md/raid5 device and affects only availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.