CVE-2026-74372
In the Linux kernel, the following vulnerability has been resolved: raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path In raid1_write_request(), each per-mirror loop iteration begins by incrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a badblock within the requested range, the code jumps to err_handle without dropping the reference taken for the current mirror. err_handle's cleanup loop will only decrements for k < i and r1_bio->bios[k] is non-NULL. The current slot is therefore skipped, leaving its nr_pending reference leaked permanently. The reference prevents the rdev from ever being removed, since raid1_remove_conf() refuses to remove an rdev with nr_pending > 0. Fix this by calling rdev_dec_pending() before jumping to err_handle.
Affected versions
Linux kernel versions
6.13
and later are affected. Fixed in
6.18.40,
7.1.5,
7.2
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-74372?
CVE-2026-74372 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.13 onward and has been patched in 6.18.40, 7.1.5 and 7.2. CVE-2026-74372 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74372?
Yes. CVE-2026-74372 has been patched. Fixed versions include 6.18.40, 7.1.5 and 7.2. If you are running Linux kernel 6.13 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74372 actively exploited?
No. CVE-2026-74372 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.