CVE-2026-72437

Not scored yetLast modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry

When a read is retried, raid1_read_request() may be called with a pre-allocated r1_bio. If wait_read_barrier() fails for a REQ_NOWAIT read, the bio is completed and the function returns immediately. In this case the existing r1_bio is leaked.

This fixes a leak of pre-allocated r1_bio structures for retried reads.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < d1eda529a4bf6b866d02755723ee0eb1f037a5ed; >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < c66ed3e6371f5dba8f5d8ab810d6683ddc99201e; >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < db58075bc9c2ad2731f9c063859b47104bc2e7ef; >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < 6d92dbd73d19a0622f60352ce9d9379f7a760112; >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < c6e6354295845698d2fdfa20b71fc404786f7e93; >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < 69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12
LinuxLinux5.17

References

Timeline

Published
Aug 15, 2026
Last modified
Nov 6, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-724387.5In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes_pending and barrier reference leaks on discard faCVE-2026-72439In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes_pending leak on write request failures raid10_maCVE-2026-72449.8A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of theCVE-2026-724407.1In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix writes_pending and barrier reference leaks on write failuCVE-2026-72441In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram_recvmsg() KMSAN reported a keCVE-2026-724429.8In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nf_fCVE-2026-72443In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 CVE-2026-724447.8In the Linux kernel, the following vulnerability has been resolved: flow_dissector: check device type before reading ETH_ADDRS __skb_flow_CVE-2026-72445In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: clear opened when stream enable fails On enableCVE-2026-724467.8In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface CVE-2026-72447In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctp_diag SCTP_DIAG eCVE-2026-72448In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown The send-que
CVE-2026-72437: Unscored | Vulnix