CVE-2026-72437md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry When a read is retried, raid1_read_request() may be called with a pre-allocated r1_bio. If wait_read_barrier() fails for a REQ_NOWAIT read, the bio is completed and the function returns immediately. In this case the existing r1_bio is leaked. This fixes a leak of pre-allocated r1_bio structures for retried reads.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 88% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca – < d1eda529a4bf6b866d02755723ee0eb1f037a5ed
- affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca – < c66ed3e6371f5dba8f5d8ab810d6683ddc99201e
- affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca – < db58075bc9c2ad2731f9c063859b47104bc2e7ef
- affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca – < 6d92dbd73d19a0622f60352ce9d9379f7a760112
- affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca – < c6e6354295845698d2fdfa20b71fc404786f7e93
- affected 5aa705039c4fca84575539bfa2b8a28454a3d2ca – < 69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12
- affected 5.17
- unaffected < 5.17
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.97 – ≤ 6.12.*
- unaffected 6.18.40 – ≤ 6.18.*
- unaffected 7.1.5 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References6
- https://git.kernel.org/stable/c/d1eda529a4bf6b866d02755723ee0eb1f037a5ed (opens in a new tab)
- https://git.kernel.org/stable/c/c66ed3e6371f5dba8f5d8ab810d6683ddc99201e (opens in a new tab)
- https://git.kernel.org/stable/c/db58075bc9c2ad2731f9c063859b47104bc2e7ef (opens in a new tab)
- https://git.kernel.org/stable/c/6d92dbd73d19a0622f60352ce9d9379f7a760112 (opens in a new tab)
- https://git.kernel.org/stable/c/c6e6354295845698d2fdfa20b71fc404786f7e93 (opens in a new tab)
- https://git.kernel.org/stable/c/69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-59336 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-72437)Record last updated .