CVE-2026-72438

A flaw was found in the Linux kernel's multiple device (MD) driver, specifically in the RAID10 implementation. This vulnerability occurs due to reference leaks in the writes_pending and barrier mechanisms during discard failures. An attacker could potentially exploit this by triggering discard failures, leading to resource exhaustion and a Denial of Service (DoS) on the affected system.

A flaw of moderate severity was found in the Linux kernel's multiple device (md) driver, in the RAID10 implementation. When handling discard requests, several failure paths in raid10_handle_discard() complete the bio without releasing the writes_pending reference acquired by md_write_start(), and allocation failures of discard splits after wait_barrier() can return without calling allow_barrier(), leaking a barrier reference. A local attacker able to trigger discard failures against an md RAID10 array could exploit these reference leaks to leave write accounting or barrier state unbalanced, which can stall later writes or array recovery operations and result in a denial of service for the array. The flaw affects availability only; there is no impact on confidentiality or integrity.

Red Hat Enterprise Linux 7 and the RHEL 8.4 and 8.6 update streams are not affected because the vulnerable code is not present in those kernels. The affected RHEL 8, RHEL 9, and RHEL 10 kernel and kernel-rt streams and the Red Hat In-Vehicle OS 2 kernel streams are affected, with the fix deferred to a future update; the residual risk is a local denial of service limited to md RAID10 arrays.

Red Hat rates this flaw Moderate severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access able to issue discard I/O and is not network-reachable. This differs from the upstream CVE record, which assigns a higher score (7.5) using a network attack vector that does not match the verified attack path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.