---
id: CVE-2026-72438
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/raid10: fix writes_pending and barrier reference leaks on discard failures

  raid10_make_request() acquires a writes_pending reference with
  md_write_start() before ca…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/raid10: fix writes_pending and barrier reference leaks on discard failures

  raid10_make_request() acquires a writes_pending reference with
  md_write_start() before ca…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c9aa889b035fca4598ae985a0f0c76ebbb547ad2 <
    fea33968592559a55a3f5a96a6386bebcaf988a8
  - >-
    Linux >= c9aa889b035fca4598ae985a0f0c76ebbb547ad2 <
    11b35d1906a7277a3d64afe34224133b44327328
  - >-
    Linux >= c9aa889b035fca4598ae985a0f0c76ebbb547ad2 <
    d1324b41dabd26787559efaeb430643c627c1eb0
  - >-
    Linux >= c9aa889b035fca4598ae985a0f0c76ebbb547ad2 <
    393d687131d8aa8c7e4de2cb494438e145d20fc2
  - Linux 39db562b3fedb93978a7e42dd216b306740959f8
  - Linux >= 5.15.111 < 5.16
  - Linux 5.17
published: '2026-08-15'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:17.647'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72438'
references:
  - url: 'https://git.kernel.org/stable/c/11b35d1906a7277a3d64afe34224133b44327328'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/393d687131d8aa8c7e4de2cb494438e145d20fc2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d1324b41dabd26787559efaeb430643c627c1eb0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fea33968592559a55a3f5a96a6386bebcaf988a8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.0063
epssPercentile: 0.4797
ingestedAt: '2026-09-21T13:37:22.843Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix writes_pending and barrier reference leaks on discard failures

raid10_make_request() acquires a writes_pending reference with
md_write_start() before calling raid10_handle_discard(). Several failure
paths in raid10_handle_discard() complete the bio and return without
releasing the corresponding reference, causing md_write_end() to be
skipped.

Call md_write_end() before returning from these failure paths to keep
writes_pending accounting balanced.

Additionally, discard split allocation failures can occur after
wait_barrier() succeeds. Those paths return without calling
allow_barrier(), leaking the associated barrier reference.

Release the barrier before returning from those paths.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.