CVE-2026-72440

A flaw was found in the Linux kernel's RAID1 (Redundant Array of Independent Disks Level 1) implementation. During write failures, the md/raid1 module may fail to release writes_pending and barrier references. This oversight can lead to a resource leak, potentially causing system instability or a Denial of Service (DoS) condition.

A flaw was found in the Linux kernel's md/raid1 implementation. When a write to a RAID1 array fails, several error paths in raid1_write_request() complete the block I/O request without releasing the writes_pending reference acquired by md_write_start(), and when wait_blocked_rdev() fails after wait_barrier() has succeeded, the barrier reference is not released. A local user able to issue writes to a filesystem backed by an md RAID1 device could trigger these write-failure paths, leaking references and leaving the array in an unbalanced state that can cause later operations to wait indefinitely or stall storage recovery and write processing, resulting in a denial of service. Red Hat Product Security rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because it is reachable only through local block I/O paths on md RAID1 devices and has no confidentiality or integrity impact; this differs from the CVEORG severity of 7.1 (Important), which assumes a network attack vector that the flaw's code paths do not support. The kernel and kernel-rt components in Red Hat Enterprise Linux 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2, are affected; the fix is currently deferred for these streams because this is a Moderate-severity reference leak in error-handling paths, and the residual risk remains a local denial of service through repeated triggering of write-failure paths until the fix is delivered. Red Hat Enterprise Linux 7 (kernel and kernel-rt) and the Red Hat Enterprise Linux 8.4 and 8.6 update streams are not affected because the vulnerable code is not present in those versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.