{"id":"CVE-2026-74376","summary":"md/raid10: reset read_slot when reusing r10bio for discard","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: reset read_slot when reusing r10bio for discard\n\nput_all_bios() always drops devs[i].bio, but it only drops\ndevs[i].repl_bio when r10_bio-\u003eread_slot \u003c 0. If discard reuses an\nr10bio that was previously used for a read, read_slot can still be\nnon-negative, and discard cleanup can skip bio_put() on repl_bio.\n\nReset read_slot to -1 when preparing an r10bio for discard so the\nreplacement bio is always released correctly.","modified":"2026-08-18T03:56:46.970522506Z","published":"2026-08-15T05:58:55.023Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74376.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3cb2a606ce4902eceabe68338df0653312f861f8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/561c9711e4f545d6464a023168bdee03b00fa945"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6b8a26af065ddc93de2aa5c9f0df98dce9723442"},{"type":"WEB","url":"https://git.kernel.org/stable/c/742e4afd247d9c972695227716b03d432a7e1d26"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b7313f23ea5a79b199a007bfad64a866cc2c22e7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ce3030e92f14362880055de5fe3c258971118853"},{"type":"WEB","url":"https://git.kernel.org/stable/c/eb04e3e9c14ed15914f5fd2eae8b6435f54f095f"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74376.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74376"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"d30588b2731fb01e1616cf16c3fe79a1443e29aa"},{"fixed":"3cb2a606ce4902eceabe68338df0653312f861f8"},{"fixed":"561c9711e4f545d6464a023168bdee03b00fa945"},{"fixed":"ce3030e92f14362880055de5fe3c258971118853"},{"fixed":"742e4afd247d9c972695227716b03d432a7e1d26"},{"fixed":"b7313f23ea5a79b199a007bfad64a866cc2c22e7"},{"fixed":"eb04e3e9c14ed15914f5fd2eae8b6435f54f095f"},{"fixed":"6b8a26af065ddc93de2aa5c9f0df98dce9723442"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74376.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.13.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74376.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}