CVE-2026-74375

A flaw was found in the Linux kernel's RAID1 and RAID10 subsystems. When handling read errors, a specific sequence of operations involving cloned I/O requests and array suspension can lead to a deadlock. This can cause the system to become unresponsive, resulting in a Denial of Service (DoS).

A low impact flaw was found in the md/raid1 and md/raid10 drivers of the Linux kernel as shipped in Red Hat Enterprise Linux 8, 9, and 10 and in Red Hat In-Vehicle OS. While handling a read error on a RAID1 or RAID10 array, the raid1d/raid10d resubmission path may re-submit a split md cloned bio while the array is suspended. Because the cloned bio already holds an active_io reference, the additional reference acquisition attempted by md_handle_request() via percpu_ref_tryget_live() can wait indefinitely, causing a deadlock that leaves the array or system unresponsive, resulting in a local denial of service. Triggering this flaw requires the specific concurrency of read-error recovery on an md RAID1/RAID10 array with array suspension by a local user able to generate I/O to the array; it impacts availability only, with no effect on confidentiality or integrity. For these reasons Red Hat rates this flaw Low severity, although the assigned Red Hat CVSS 3.1 base score is 5.5 (Moderate, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 6 and 7, and the RHEL 8.4, 8.6, 8.8, and 9.2 update streams are not affected because the code that introduced this issue is not present in those kernels. Fixes for the affected streams are currently deferred (resolution DEFER) to a future maintenance update; the residual risk is a local denial of service limited to the narrow triggering conditions described above.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.