{"id":"CVE-2026-72420","title":"md/raid5: avoid R5_Overlap races while breaking stripe batches","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: avoid R5_Overlap races while breaking stripe batches\n\nKCSAN report a race in break_stripe_batch_list() vs. raid5_make_request()\non sh->dev[i].flags (plain wor…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-833"],"vendor":"Linux","product":"Linux","affected":["Linux >= fb642b92c267beeefd352af9bc461eac93a7552c < 158a5480d51969adeb727ff20c6fa96f063e9f9e","Linux >= fb642b92c267beeefd352af9bc461eac93a7552c < 8031b0d02bd221a5f9add4357e291fc2a527b83a","Linux >= fb642b92c267beeefd352af9bc461eac93a7552c < 4d919c9b770996365806b6c8d701912d52baa306","Linux >= fb642b92c267beeefd352af9bc461eac93a7552c < d684b72dfbd320623ccaab0779aa841190488e7c","Linux >= fb642b92c267beeefd352af9bc461eac93a7552c < 55b77337bdd088c77461588e5ec094421b89911b","Linux 4.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:49:28.867554Z"},"published":"2026-08-15","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:44:52.798Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72420","references":[{"url":"https://git.kernel.org/stable/c/158a5480d51969adeb727ff20c6fa96f063e9f9e"},{"url":"https://git.kernel.org/stable/c/8031b0d02bd221a5f9add4357e291fc2a527b83a"},{"url":"https://git.kernel.org/stable/c/4d919c9b770996365806b6c8d701912d52baa306"},{"url":"https://git.kernel.org/stable/c/d684b72dfbd320623ccaab0779aa841190488e7c"},{"url":"https://git.kernel.org/stable/c/55b77337bdd088c77461588e5ec094421b89911b"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72420.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-72420"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2516480"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72420"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72420"},{"url":"https://lore.kernel.org/linux-cve-announce/2026081525-CVE-2026-72420-69ff@gregkh/T"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00601,"epssPercentile":0.48541,"scores":{"cna":8.8,"vendor":5.5},"ingestedAt":"2026-10-16T19:46:24.397Z","slug":"CVE-2026-72420","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: avoid R5_Overlap races while breaking stripe batches\n\nKCSAN report a race in break_stripe_batch_list() vs. raid5_make_request()\non sh->dev[i].flags (plain word write vs. atomic bit op)..\n\nand .. one possible scenario is:\n\nCPU1                            CPU2\nbreak_stripe_batch_list(sh1)\n-> handle sh2\n-> lock(sh2)\n-> sh2->batch_head = NULL\n-> unlock(sh2)\n-> test_and_clear_bit(R5_Overlap, sh2->dev[i].flags)\n-> wake_up_bit(sh2->dev[i].flags)\n                                raid5_make_request()\n                                -> add_all_stripe_bios(sh2)\n                                -> lock(sh2)\n                                -> stripe_bio_overlaps(sh2) returns true\n\t\t\t\t   batch_head is NULL, so new bio overlap\n\t\t\t\t   exist bio on sh2 -> true\n                                -> set_bit(R5_Overlap, sh2->dev[i].flags)\n                                -> unlock(sh2)\n                                -> wait_on_bit(sh2->dev[i].flags)\n-> sh2->dev[i].flags = sh1->dev[i].flags & ~R5_Overlap\n\nNo wait_up_bit(), CPU2 could be wait_on_bit() forever...\n\nFix by :\n- Expand the protect zone.\n- Use batch_head's device flag's snaphot when no held head_sh->stripe_lock.\n- Move sh/head_sh->batch_head = NULL to the end of protected zone , and ,\n  any concurrent add_all_stripe_bios() grabs sh->stripe_lock now either:\n\t- see batch_head != null, and , is rejected by stripe_bio_overlaps()\n\t  under the lock (no R5_Overlap wait ) , or ,\n\t- sees batch_head == NULL, only after dev[i].flags has already been\n\t  set and the prior R5_Overlap waiters worken.\n\nKCSAN report:\n================================================\n  BUG: KCSAN: data-race in break_stripe_batch_list / raid5_make_request\n\n  write (marked) to 0xffff8e89c8117548 of 8 bytes by task 4042 on cpu 0:\n    raid5_make_request+0xea0/0x2930\n    md_handle_request+0x4a2/0xa40\n    md_submit_bio+0x109/0x1a0\n    __submit_bio+0x2ec/0x390\n    submit_bio_noacct_nocheck+0x457/0x710\n    submit_bio_noacct+0x2a7/0xc20\n    submit_bio+0x56/0x250\n    blkdev_direct_IO+0x54c/0xda0\n    blkdev_write_iter+0x38f/0x570\n    aio_write+0x22b/0x490\n    io_submit_one+0xa51/0xf70\n    __x64_sys_io_submit+0xf7/0x220\n    x64_sys_call+0x1907/0x1c60\n    do_syscall_64+0x130/0x570\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n  read to 0xffff8e89c8117548 of 8 bytes by task 4010 on cpu 5:\n    break_stripe_batch_list+0x249/0x480\n    handle_stripe_clean_event+0x720/0x9b0\n    handle_stripe+0x32fb/0x4500\n    handle_active_stripes.isra.0+0x6e0/0xa50\n    raid5d+0x7e0/0xba0\n    md_thread+0x15a/0x2d0\n    kthread+0x1e3/0x220\n    ret_from_fork+0x37a/0x410\n    ret_from_fork_asm+0x1a/0x30\n\n  value changed: 0x0000000000000019 -> 0x0000000000000099 --> R5_Overlap\n\n## Affected\n\n- `Linux >= fb642b92c267beeefd352af9bc461eac93a7552c < 158a5480d51969adeb727ff20c6fa96f063e9f9e`\n- `Linux >= fb642b92c267beeefd352af9bc461eac93a7552c < 8031b0d02bd221a5f9add4357e291fc2a527b83a`\n- `Linux >= fb642b92c267beeefd352af9bc461eac93a7552c < 4d919c9b770996365806b6c8d701912d52baa306`\n- `Linux >= fb642b92c267beeefd352af9bc461eac93a7552c < d684b72dfbd320623ccaab0779aa841190488e7c`\n- `Linux >= fb642b92c267beeefd352af9bc461eac93a7552c < 55b77337bdd088c77461588e5ec094421b89911b`\n- `Linux 4.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72420.json)","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":227191,"id":"CVE-2026-72420","ts":1792586986220,"field":"cvss","old":"5.5","new":"8.8"},{"seq":227190,"id":"CVE-2026-72420","ts":1792586986220,"field":"severity","old":"medium","new":"high"},{"seq":223631,"id":"CVE-2026-72420","ts":1792238342041,"field":"cvss","old":"8.8","new":"5.5"},{"seq":223630,"id":"CVE-2026-72420","ts":1792238342041,"field":"severity","old":"high","new":"medium"}]}