---
id: CVE-2026-72437
title: 'md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry

  When a read is retried, raid1_read_request() may be called with a
  pre-allocated r1_bio. If w…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca <
    d1eda529a4bf6b866d02755723ee0eb1f037a5ed
  - >-
    Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca <
    c66ed3e6371f5dba8f5d8ab810d6683ddc99201e
  - >-
    Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca <
    db58075bc9c2ad2731f9c063859b47104bc2e7ef
  - >-
    Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca <
    6d92dbd73d19a0622f60352ce9d9379f7a760112
  - >-
    Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca <
    c6e6354295845698d2fdfa20b71fc404786f7e93
  - >-
    Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca <
    69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12
  - Linux 5.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:55:23.931838Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:42.509Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72437'
references:
  - url: 'https://git.kernel.org/stable/c/d1eda529a4bf6b866d02755723ee0eb1f037a5ed'
  - url: 'https://git.kernel.org/stable/c/c66ed3e6371f5dba8f5d8ab810d6683ddc99201e'
  - url: 'https://git.kernel.org/stable/c/db58075bc9c2ad2731f9c063859b47104bc2e7ef'
  - url: 'https://git.kernel.org/stable/c/6d92dbd73d19a0622f60352ce9d9379f7a760112'
  - url: 'https://git.kernel.org/stable/c/c6e6354295845698d2fdfa20b71fc404786f7e93'
  - url: 'https://git.kernel.org/stable/c/69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12'
tags:
  - cve.org
epss: 0.00215
epssPercentile: 0.11959
ingestedAt: '2026-11-06T18:00:12.575Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry

When a read is retried, raid1_read_request() may be called with a
pre-allocated r1_bio. If wait_read_barrier() fails for a REQ_NOWAIT
read, the bio is completed and the function returns immediately. In this
case the existing r1_bio is leaked.

This fixes a leak of pre-allocated r1_bio structures for retried reads.

## Affected

- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < d1eda529a4bf6b866d02755723ee0eb1f037a5ed`
- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < c66ed3e6371f5dba8f5d8ab810d6683ddc99201e`
- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < db58075bc9c2ad2731f9c063859b47104bc2e7ef`
- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < 6d92dbd73d19a0622f60352ce9d9379f7a760112`
- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < c6e6354295845698d2fdfa20b71fc404786f7e93`
- `Linux >= 5aa705039c4fca84575539bfa2b8a28454a3d2ca < 69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12`
- `Linux 5.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.