CVE-2026-74372

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path

In raid1_write_request(), each per-mirror loop iteration begins by

incrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a

badblock within the requested range, the code jumps to err_handle

without dropping the reference taken for the current mirror.

err_handle's cleanup loop will only decrements for k < i and

r1_bio->bios[k] is non-NULL. The current slot is therefore skipped,

leaving its nr_pending reference leaked permanently. The reference

prevents the rdev from ever being removed, since raid1_remove_conf()

refuses to remove an rdev with nr_pending > 0.

Fix this by calling rdev_dec_pending() before jumping to err_handle.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References