From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E3503815D3 for ; Sat, 15 Aug 2026 06:37:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775848; cv=none; b=tNqcuKDDQMJV3VBaHg3G0JWvTWei+UUWz9RcWKcCe+wIsqWtp/1D7B6iqWDZ5gZST8nPd6V3Wb5w9SDPeiOLyunFO/6LQ/oiBiHjXzyJT3DzFBEb1T8RR/gGUIPSX82EfdT/GAsvrlL+YAVyrt7eT8EJ+eN++mkrRjSZ272S7MM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775848; c=relaxed/simple; bh=+urQ2pu/z0OPeEzEsF5bHrrPy+6VqpRjPBNO0PCImH4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=VoZb6xpgOA7reDOf5RJt1T57xDDEGAiQrzRZd7jb7CiI4AVkcIi6YJwZTF3D2N9h85K6iPGVMEsVKIsLTlF7D4L6sc3F/oYq/fvfzsV7Q3Q6oAgpMMuNB/tvuMn7Y9lg+0vakmFwwZykb96pi1RxZCpHOwKRReKqZQrKRnTcaEw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Ipigw8Om; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Ipigw8Om" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 953A01F00A3A; Sat, 15 Aug 2026 06:37:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786775847; bh=3cvp/W5SN6e0UdGK/CLOoZTtmKUDoZ+wVA0gLKXD2+4=; h=From:To:Cc:Subject:Date:Reply-To; b=Ipigw8OmOASmi3U5NNtpDg/nsnYhitXe341FUBtfXBT7k2J48lh0dZUYLAFyrKXc8 QcjfpX7cRzI5b246TKtE5FHJq+tU0uyYlfzJopPPUGw4EIND7l73/5ZtPJwjMqdK2Y Biw1b0hKQouBdjg8WYcE/bhaNjhW6KFgDpEF+Mok= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74372: raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path Date: Sat, 15 Aug 2026 15:11:39 +0900 Message-ID: <2026081503-CVE-2026-74372-0ee5@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2647; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=W0QUAPg1DWWYv2Z0UmHmbYET94t1YqHfjO+9DrbPP5o=; b=kA0DAAIRMUfUDdst+ykByyZiAGqAARegTMsdpIKooqLeVEI3aa2PqV03laR6XZgeCqDX87KvU IhdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAmqAARcACgkQMUfUDdst+ymdvwCfYt6K lTq8s+XDcerj1yI4DrrHtegAn1CpsVjaVuZhsIRE8WvRWYxSYAZf X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path In raid1_write_request(), each per-mirror loop iteration begins by incrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a badblock within the requested range, the code jumps to err_handle without dropping the reference taken for the current mirror. err_handle's cleanup loop will only decrements for k < i and r1_bio->bios[k] is non-NULL. The current slot is therefore skipped, leaving its nr_pending reference leaked permanently. The reference prevents the rdev from ever being removed, since raid1_remove_conf() refuses to remove an rdev with nr_pending > 0. Fix this by calling rdev_dec_pending() before jumping to err_handle. The Linux kernel CVE team has assigned CVE-2026-74372 to this issue. Affected and fixed versions =========================== Issue introduced in 6.13 with commit f2a38abf5f1c5aeb3be8e9f4d3d815c867fff7ca and fixed in 6.18.40 with commit 5ac9e793ba2583d72740d929e7858a6c82e22ed5 Issue introduced in 6.13 with commit f2a38abf5f1c5aeb3be8e9f4d3d815c867fff7ca and fixed in 7.1.5 with commit 731485617bf862f1289c3f40ed1f800d0475826f Issue introduced in 6.13 with commit f2a38abf5f1c5aeb3be8e9f4d3d815c867fff7ca and fixed in 7.2-rc1 with commit 909d9dc3b5730c8ed7b764c68bc788342df2a07b Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74372 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/md/raid1.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/5ac9e793ba2583d72740d929e7858a6c82e22ed5 https://git.kernel.org/stable/c/731485617bf862f1289c3f40ed1f800d0475826f https://git.kernel.org/stable/c/909d9dc3b5730c8ed7b764c68bc788342df2a07b