CVE-2026-74372

A flaw was found in the Linux kernel's RAID1 subsystem. When a REQ_ATOMIC write operation encounters a bad block, a reference to the RAID device (rdev) is not properly released. This resource leak prevents the affected RAID device from being removed, potentially leading to a denial of service (DoS) condition where system resources become permanently unavailable.

A moderate-severity flaw was found in the Linux kernel's md/raid1 driver, where a reference count leak occurs in the error path of a REQ_ATOMIC write that encounters a bad block. In raid1_write_request(), each per-mirror loop iteration increments rdev->nr_pending, but when a REQ_ATOMIC write finds a bad block within the requested range, the code jumps to the error handler without dropping the reference taken for the current mirror. The error handler's cleanup loop skips the current slot, leaving the nr_pending reference leaked permanently. Because raid1_remove_conf() refuses to remove an rdev with nr_pending > 0, the affected RAID device can never be removed from the array, resulting in a denial of service. Exploitation requires local write access to an md RAID1 array that supports atomic writes, and triggering depends on a REQ_ATOMIC write hitting a bad-block range. There is no impact on confidentiality or integrity; Red Hat rated this flaw Moderate (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 5.5). In Red Hat Enterprise Linux, the vulnerable code was introduced with the md/raid1 atomic write support backport, so this flaw affects the kernel and kernel-rt packages in RHEL 9.8.z, RHEL 9.9, RHEL 10.2.z, and RHEL 10.3, and Red Hat In-Vehicle OS 2.0 and 2.1. RHEL 6, RHEL 7, RHEL 8, and the RHEL 9.2/9.4/9.6 and RHEL 10.0 update streams are not affected because the vulnerable code is not present in those releases. The fix for the affected streams is currently deferred. The residual risk of deferral is limited: exploitation requires local access and a specific bad-block condition during atomic writes, and the consequence is confined to preventing removal of the affected RAID device (a local denial of service) rather than memory exhaustion, data corruption, or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.