{"id":"CVE-2026-74372","summary":"raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nraid1: fix nr_pending leak in REQ_ATOMIC bad-block error path\n\nIn raid1_write_request(), each per-mirror loop iteration begins by\nincrementing rdev-\u003enr_pending. If a REQ_ATOMIC write encounters a\nbadblock within the requested range, the code jumps to err_handle\nwithout dropping the reference taken for the current mirror.\n\nerr_handle's cleanup loop will only decrements for k \u003c i and\nr1_bio-\u003ebios[k] is non-NULL. The current slot is therefore skipped,\nleaving its nr_pending reference leaked permanently. The reference\nprevents the rdev from ever being removed, since raid1_remove_conf()\nrefuses to remove an rdev with nr_pending \u003e 0.\n\nFix this by calling rdev_dec_pending() before jumping to err_handle.","modified":"2026-08-18T03:31:29.149763120Z","published":"2026-08-15T05:58:52.306Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74372.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/5ac9e793ba2583d72740d929e7858a6c82e22ed5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/731485617bf862f1289c3f40ed1f800d0475826f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/909d9dc3b5730c8ed7b764c68bc788342df2a07b"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74372.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74372"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f2a38abf5f1c5aeb3be8e9f4d3d815c867fff7ca"},{"fixed":"5ac9e793ba2583d72740d929e7858a6c82e22ed5"},{"fixed":"731485617bf862f1289c3f40ed1f800d0475826f"},{"fixed":"909d9dc3b5730c8ed7b764c68bc788342df2a07b"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74372.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74372.json"}}],"schema_version":"1.9.0"}