Bug 2516580 (CVE-2026-72437)

Summary:	CVE-2026-72437 kernel: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's md/raid1 component. When a read operation is retried with the `REQ_NOWAIT` flag set, and the `wait_read_barrier()` function fails, a pre-allocated `r1_bio` structure may not be properly freed. This resource leak can accumulate over time, potentially leading to a denial of service (DoS) due to memory exhaustion.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:20:04 UTC

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry

When a read is retried, raid1_read_request() may be called with a
pre-allocated r1_bio. If wait_read_barrier() fails for a REQ_NOWAIT
read, the bio is completed and the function returns immediately. In this
case the existing r1_bio is leaked.

This fixes a leak of pre-allocated r1_bio structures for retried reads.

Comment 1 Keith Grant 2026-08-19 16:35:24 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081528-CVE-2026-72437-a3cd@gregkh/T