CVE-2026-74376 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: reset read_slot when reusing r10bio for discard
put_all_bios() always drops devs[i].bio, but it only drops
devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an
r10bio that was previously used for a read, read_slot can still be non-negative, and discard cleanup can skip bio_put() on repl_bio.
Reset read_slot to -1 when preparing an r10bio for discard so the replacement bio is always released correctly.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's md/raid10 subsystem where improper handling of bio structures during discard operations can lead to resource leaks and potential system instability. The issue specifically affects the raid10 implementation which manages RAID 10 arrays through mirror and stripe combinations. When processing discard requests, the kernel must properly manage the lifecycle of bio structures associated with both read and replacement operations within the redundant array configuration.
The technical flaw occurs in the put_all_bios() function where the code consistently releases devs[i].bio but only conditionally releases devs[i].repl_bio based on whether r10_bio->read_slot is negative. This conditional logic creates a scenario where if a r10bio structure is reused for discard operations after previously serving read requests, the read_slot field retains its non-negative value from prior operations. Consequently, when cleanup occurs for discard operations, the replacement bio reference remains unreleased, leading to memory leaks and potential corruption of the array's internal data structures.
The operational impact of this vulnerability manifests as progressive resource consumption within the kernel's storage subsystem, where discarded bio structures accumulate in memory without proper cleanup. This can eventually lead to system performance degradation, increased memory pressure, and potentially system instability when the array management subsystem exhausts available resources. The issue is particularly concerning in high-throughput environments where frequent discard operations occur, such as in database servers or storage appliances utilizing RAID 10 configurations.
This vulnerability aligns with CWE-404, representing improper resource release or cleanup, and relates to ATT&CK technique T1490, which involves data destruction through disk content modification. The fix implements a proper reset of the read_slot field to -1 when preparing r10bio structures for discard operations, ensuring consistent cleanup behavior regardless of the structure's prior usage pattern. This remediation addresses the root cause by enforcing deterministic bio release semantics within the RAID 10 subsystem, preventing conditional logic from interfering with resource management and maintaining proper reference counting across all bio operations.
The fix demonstrates adherence to secure programming practices through explicit resource management and state initialization before reuse. By ensuring read_slot is reset to its initial state before discard processing begins, the kernel maintains consistent behavior regardless of whether a r10bio structure has been previously used for read operations. This approach prevents the conditional release logic from creating inconsistent cleanup paths and guarantees that all bio references are properly accounted for during array discard operations, thereby maintaining system stability and preventing resource leakage in enterprise storage environments relying on Linux RAID 10 configurations.