CVE-2026-74373

A flaw was found in the Linux kernel's md/raid1 and raid10 components. This flaw involves incorrect accounting of block I/O (bio) operations for split cloned bios. When a failed bio is split and resubmitted, the system may either double count or miss accounting for these bios. This can lead to resource management issues and potential system instability.

A low impact flaw was found in the Linux kernel's md/raid1 and md/raid10 RAID drivers, affecting Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS 2. The code did not reliably determine whether a block I/O (bio) was an md cloned bio: when a failed bio was split and resubmitted via bio_submit_split_bioset() on the error path, the kernel could either double-count or omit block I/O accounting for md cloned bios. This is an accounting-correctness defect on a read-error/recovery path of an existing md RAID1 or RAID10 device; it can lead to incorrect I/O accounting and resource-management issues, but it does not indicate memory corruption, information disclosure, or privilege escalation. Red Hat Enterprise Linux 7 and the earlier RHEL 8 (8.4, 8.6, 8.8) and RHEL 9 (9.2) update streams are not affected because the vulnerable code is not present in those streams. Because this is a low-severity accounting error on a rare error path, the fix is deferred for the affected streams; the residual risk is inaccurate I/O accounting data and degraded accounting-based resource management on md RAID arrays rather than direct system compromise. Red Hat rates this flaw LOW impact, which is lower than the CVSS:3.1 score of 5.5 (MODERATE, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) would suggest, because reliable triggering requires a failing I/O on an existing md RAID device and the consequence is limited to accounting correctness.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.