CVE-2026-74376

A flaw was found in the Linux kernel's md/raid10 component. This vulnerability occurs when a specific internal data structure, used for disk operations, is reused for a discard operation without properly resetting a critical flag. This oversight can lead to improper release of system resources, potentially causing system instability or a denial of service (DoS).

A flaw of low impact was found in the Linux kernel's md/raid10 driver in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS 2. When a discard operation reuses an r10bio structure that was previously used for a read request, the read_slot field is not reset, so cleanup in put_all_bios() can skip bio_put() on the replacement bio. Repeated discard operations on an md/raid10 array can therefore leak bios and associated memory, resulting in resource exhaustion and a local denial of service. Triggering the flaw requires local access to a system performing discard operations on an md/raid10 array; there is no impact on confidentiality or integrity and the flaw is not network-reachable. The vulnerable code is not present in Red Hat Enterprise Linux 7 Extended Lifecycle Support (kernel and kernel-rt), which is therefore not affected. Because the issue is limited to availability impact from a local actor, with no privilege escalation, information disclosure, or memory corruption involved, the fix is currently deferred for the affected Red Hat products; the residual risk is a local denial of service through resource exhaustion on systems that perform frequent discard operations on md/raid10 arrays. The CVE.org record scores this issue 9.8 CRITICAL, which assumes network-reachable, unauthenticated exploitation with confidentiality and integrity impact; Red Hat assesses this flaw as LOW severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and only availability is affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.