{"id":"CVE-2026-72438","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix writes_pending and barrier reference leaks on discard failures\n\nraid10_make_request() acquires a writes_pending reference with\nmd_write_start() before ca…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix writes_pending and barrier reference leaks on discard failures\n\nraid10_make_request() acquires a writes_pending reference with\nmd_write_start() before ca…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= c9aa889b035fca4598ae985a0f0c76ebbb547ad2 < fea33968592559a55a3f5a96a6386bebcaf988a8","Linux >= c9aa889b035fca4598ae985a0f0c76ebbb547ad2 < 11b35d1906a7277a3d64afe34224133b44327328","Linux >= c9aa889b035fca4598ae985a0f0c76ebbb547ad2 < d1324b41dabd26787559efaeb430643c627c1eb0","Linux >= c9aa889b035fca4598ae985a0f0c76ebbb547ad2 < 393d687131d8aa8c7e4de2cb494438e145d20fc2","Linux 39db562b3fedb93978a7e42dd216b306740959f8","Linux >= 5.15.111 < 5.16","Linux 5.17"],"published":"2026-08-15","updated":"2026-09-21","sourceUpdated":"2026-09-21T14:17:17.647","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72438","references":[{"url":"https://git.kernel.org/stable/c/11b35d1906a7277a3d64afe34224133b44327328","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/393d687131d8aa8c7e4de2cb494438e145d20fc2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1324b41dabd26787559efaeb430643c627c1eb0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fea33968592559a55a3f5a96a6386bebcaf988a8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.0063,"epssPercentile":0.47898,"ingestedAt":"2026-09-21T13:37:22.843Z","slug":"CVE-2026-72438","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix writes_pending and barrier reference leaks on discard failures\n\nraid10_make_request() acquires a writes_pending reference with\nmd_write_start() before calling raid10_handle_discard(). Several failure\npaths in raid10_handle_discard() complete the bio and return without\nreleasing the corresponding reference, causing md_write_end() to be\nskipped.\n\nCall md_write_end() before returning from these failure paths to keep\nwrites_pending accounting balanced.\n\nAdditionally, discard split allocation failures can occur after\nwait_barrier() succeeds. Those paths return without calling\nallow_barrier(), leaking the associated barrier reference.\n\nRelease the barrier before returning from those paths.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}