{"id":"CVE-2026-72437","title":"md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry\n\nWhen a read is retried, raid1_read_request() may be called with a\npre-allocated r1_bio. If w…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < d1eda529a4bf6b866d02755723ee0eb1f037a5ed","Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < c66ed3e6371f5dba8f5d8ab810d6683ddc99201e","Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < db58075bc9c2ad2731f9c063859b47104bc2e7ef","Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < 6d92dbd73d19a0622f60352ce9d9379f7a760112","Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < c6e6354295845698d2fdfa20b71fc404786f7e93","Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < 69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12","Linux 5.17"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:55:23.931838Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:05:42.509Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72437","references":[{"url":"https://git.kernel.org/stable/c/d1eda529a4bf6b866d02755723ee0eb1f037a5ed"},{"url":"https://git.kernel.org/stable/c/c66ed3e6371f5dba8f5d8ab810d6683ddc99201e"},{"url":"https://git.kernel.org/stable/c/db58075bc9c2ad2731f9c063859b47104bc2e7ef"},{"url":"https://git.kernel.org/stable/c/6d92dbd73d19a0622f60352ce9d9379f7a760112"},{"url":"https://git.kernel.org/stable/c/c6e6354295845698d2fdfa20b71fc404786f7e93"},{"url":"https://git.kernel.org/stable/c/69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12"}],"tags":["cve.org"],"epss":0.00215,"epssPercentile":0.11959,"ingestedAt":"2026-11-06T18:00:12.575Z","slug":"CVE-2026-72437","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry\n\nWhen a read is retried, raid1_read_request() may be called with a\npre-allocated r1_bio. If wait_read_barrier() fails for a REQ_NOWAIT\nread, the bio is completed and the function returns immediately. In this\ncase the existing r1_bio is leaked.\n\nThis fixes a leak of pre-allocated r1_bio structures for retried reads.\n\n## Affected\n\n- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < d1eda529a4bf6b866d02755723ee0eb1f037a5ed`\n- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < c66ed3e6371f5dba8f5d8ab810d6683ddc99201e`\n- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < db58075bc9c2ad2731f9c063859b47104bc2e7ef`\n- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < 6d92dbd73d19a0622f60352ce9d9379f7a760112`\n- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < c6e6354295845698d2fdfa20b71fc404786f7e93`\n- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < 69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12`\n- `Linux 5.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}