From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 319EC386575 for ; Sat, 15 Aug 2026 06:38:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775904; cv=none; b=OAI4eBIJK/pbJUb1urZzPqAhGpXyZs/n1LE+Rso/0ycCx82dvKG8NdK24FmripPdRwAE4oM4Uf9xPZczOJLB6Yqu+FsaK1TiUkxqMNoUBj6DBTmFEc0QcXGfcRgZVo23IOWcKAju5sfPDPv8hMzfQOfIhObfn9v118aSRVSbdaw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775904; c=relaxed/simple; bh=KuNTMLSEpi9/KzuNvk3NDcm6BB0ftuGOm2TwALGzCvs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=LP+Pl9dF0dTZyIDl7qeTomsz/YDBn+Vb3bh5811dNi/TFgQLin7Lv2p9Y+J+x8owM+s7U9CPNc1pqwzC61mVAdOSzuGgAsUa34Nra0soPFOO1q1rpntG4T7NQHyTItlOx804KweWxmZnkFSwmw4eDDlwpmHzONVXQ/kbxEyPYzg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=nWoqCUJR; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="nWoqCUJR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87DF01F000E9; Sat, 15 Aug 2026 06:38:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786775903; bh=NVd7S7IBxJjRu/XAKiu8GwA9GFVCGTn/CVRPT5UW/HI=; h=From:To:Cc:Subject:Date:Reply-To; b=nWoqCUJRgCWr6oCmAWJBCRfGGifmqUEjA6/PoA9aqUj/Hmqx1PYT8/vrQ9lLS0SGe 06O5bkEsOGnCtWbf9D9EyqC9onRPy6rzcn7yfjZh2E+O80UzBML9FTmbDm4RNo7sA9 sxRnA4pfbLOsn9Q2pyLeJgW+9DcbJv61onvjFGJk= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard Date: Sat, 15 Aug 2026 15:11:43 +0900 Message-ID: <2026081504-CVE-2026-74376-e253@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3286; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=HYbSPAGDyfIwF/Md/QmZDzsraHxyqI2aMdEpk0Tmeuw=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNjBLVH7rSPqUt6r9t8fOAIsOjp/sZObb5mVycti1LM 3SC0eOfHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRdA2G+dH/VuT7d9zv2f3q WGarodkXgaVfXBkWnGZ+ssd9mneWWtjyX15nzPmlV63RAQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read_slot when reusing r10bio for discard put_all_bios() always drops devs[i].bio, but it only drops devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an r10bio that was previously used for a read, read_slot can still be non-negative, and discard cleanup can skip bio_put() on repl_bio. Reset read_slot to -1 when preparing an r10bio for discard so the replacement bio is always released correctly. The Linux kernel CVE team has assigned CVE-2026-74376 to this issue. Affected and fixed versions =========================== Issue introduced in 5.13 with commit d30588b2731fb01e1616cf16c3fe79a1443e29aa and fixed in 5.15.212 with commit 3cb2a606ce4902eceabe68338df0653312f861f8 Issue introduced in 5.13 with commit d30588b2731fb01e1616cf16c3fe79a1443e29aa and fixed in 6.1.178 with commit 561c9711e4f545d6464a023168bdee03b00fa945 Issue introduced in 5.13 with commit d30588b2731fb01e1616cf16c3fe79a1443e29aa and fixed in 6.6.145 with commit ce3030e92f14362880055de5fe3c258971118853 Issue introduced in 5.13 with commit d30588b2731fb01e1616cf16c3fe79a1443e29aa and fixed in 6.12.97 with commit 742e4afd247d9c972695227716b03d432a7e1d26 Issue introduced in 5.13 with commit d30588b2731fb01e1616cf16c3fe79a1443e29aa and fixed in 6.18.40 with commit b7313f23ea5a79b199a007bfad64a866cc2c22e7 Issue introduced in 5.13 with commit d30588b2731fb01e1616cf16c3fe79a1443e29aa and fixed in 7.1.5 with commit eb04e3e9c14ed15914f5fd2eae8b6435f54f095f Issue introduced in 5.13 with commit d30588b2731fb01e1616cf16c3fe79a1443e29aa and fixed in 7.2-rc1 with commit 6b8a26af065ddc93de2aa5c9f0df98dce9723442 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74376 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/md/raid10.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3cb2a606ce4902eceabe68338df0653312f861f8 https://git.kernel.org/stable/c/561c9711e4f545d6464a023168bdee03b00fa945 https://git.kernel.org/stable/c/ce3030e92f14362880055de5fe3c258971118853 https://git.kernel.org/stable/c/742e4afd247d9c972695227716b03d432a7e1d26 https://git.kernel.org/stable/c/b7313f23ea5a79b199a007bfad64a866cc2c22e7 https://git.kernel.org/stable/c/eb04e3e9c14ed15914f5fd2eae8b6435f54f095f https://git.kernel.org/stable/c/6b8a26af065ddc93de2aa5c9f0df98dce9723442