CVE-2026-72437 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
When a read is retried, raid1_read_request() may be called with a pre-allocated r1_bio. If wait_read_barrier() fails for a REQ_NOWAIT read, the bio is completed and the function returns immediately. In this case the existing r1_bio is leaked.
This fixes a leak of pre-allocated r1_bio structures for retried reads.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the Linux kernel's md/raid1 subsystem where memory management issues occur during read operations on RAID1 arrays. This particular flaw manifests when a read request is processed through the raid1_read_request() function, which handles pre-allocated r1_bio structures for performance optimization. The issue specifically occurs under conditions where a read operation must be retried due to blocking scenarios, creating a scenario where memory allocation and deallocation logic becomes inconsistent.
When a read request with the REQ_NOWAIT flag is processed, the system attempts to avoid blocking operations by using pre-allocated r1_bio structures. However, during retry logic implementation, if wait_read_barrier() function fails for such a non-blocking read operation, the code path completes the bio immediately without properly releasing the pre-allocated r1_bio structure that was originally intended for reuse. This creates a memory leak where the r1_bio structure remains allocated in memory but is no longer referenced by any active process or data structure.
The technical flaw stems from improper resource management within the RAID1 subsystem's retry mechanism, specifically violating proper memory lifecycle management principles. The CWE-401 category applies here as this represents a classic memory leak vulnerability where allocated resources are not properly freed, leading to gradual memory consumption over time. The issue directly impacts system stability and performance as the leaked r1_bio structures accumulate during high I/O load scenarios, particularly in environments with frequent read retry operations.
From an operational perspective, this vulnerability can lead to progressive memory exhaustion on systems running RAID1 arrays under heavy I/O workloads. The leak becomes more pronounced when multiple concurrent read operations are being retried simultaneously, as each failed non-blocking read operation contributes to the accumulation of leaked structures. Systems utilizing storage arrays with high read contention or network-attached storage configurations are particularly susceptible to this issue, as these environments generate more frequent retry scenarios.
The mitigation strategy involves ensuring proper cleanup of pre-allocated r1_bio structures regardless of whether a read operation completes successfully or fails during the wait_read_barrier() phase. This requires modifying the raid1_read_request() function to always release the r1_bio structure when the REQ_NOWAIT flag is set and the operation cannot proceed without blocking, preventing the memory leak from occurring in the first place.
This vulnerability aligns with ATT&CK technique T1484.001 which covers "Privilege Escalation through Lateral Movement" by potentially enabling denial of service conditions that could compromise system availability. The memory leak scenario could eventually lead to system instability or crashes, particularly in resource-constrained environments where memory exhaustion occurs more rapidly.
The fix implementation typically requires updating the error handling path within the RAID1 subsystem to ensure that pre-allocated r1_bio structures are properly freed even when operations fail due to blocking conditions. This modification ensures that all code paths through raid1_read_request() maintain proper memory management discipline, preventing resource leaks while preserving the intended performance optimizations of using pre-allocated structures for common read operations.
The vulnerability demonstrates the complexity involved in managing memory resources in kernel space where multiple optimization strategies can interact in unexpected ways. It highlights the importance of rigorous testing and validation of error handling paths, particularly when dealing with non-blocking I/O operations that must gracefully handle various failure conditions while maintaining resource consistency.