---
id: CVE-2026-72440
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/raid1: fix writes_pending and barrier reference leaks on write failures

  raid1_make_request() acquires a writes_pending reference with
  md_write_start() before callin…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/raid1: fix writes_pending and barrier reference leaks on write failures

  raid1_make_request() acquires a writes_pending reference with
  md_write_start() before callin…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca <
    7a450460687919e79b5f8503bdeb13ecf4cca311
  - >-
    Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca <
    bffbbfcbd9393e315a7a4286dcd70e875265db9a
  - >-
    Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca <
    8e065a1602511282fc0da2dc89445e0eb71a681c
  - Linux 5.17
published: '2026-08-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:43.803'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72440'
references:
  - url: 'https://git.kernel.org/stable/c/7a450460687919e79b5f8503bdeb13ecf4cca311'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8e065a1602511282fc0da2dc89445e0eb71a681c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bffbbfcbd9393e315a7a4286dcd70e875265db9a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.0038
epssPercentile: 0.30265
ingestedAt: '2026-10-15T11:00:41.681Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: fix writes_pending and barrier reference leaks on write failures

raid1_make_request() acquires a writes_pending reference with
md_write_start() before calling raid1_write_request(). Several failure
paths in raid1_write_request() complete the bio and return without
reaching the normal write completion path, causing the corresponding
md_write_end() to be skipped.

Make raid1_write_request() return a status indicating whether the write
request was successfully queued. This allows raid1_make_request() to
call md_write_end() when raid1_write_request() fails.

Additionally, if wait_blocked_rdev() fails after wait_barrier()
succeeds, the associated barrier reference is not released.

Call allow_barrier() before returning from that path to keep the barrier
accounting balanced.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.