PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72420 Linux CVE debrief

A race condition vulnerability was found in the Linux kernel's md/raid5 implementation. The issue occurs in the break_stripe_batch_list() and raid5_make_request() functions, which can lead to a deadlock situation. The vulnerability has been resolved by expanding the protect zone, using batch_head's device flag's snapshot when no held head_sh->stripe_lock, and moving sh/head_sh->batch_head = NULL to the end of the protected zone.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-08-15
Advisory published
2026-08-15
Advisory updated
2026-08-15

Who should care

Linux kernel developers and administrators who use md/raid5 implementation

Technical summary

The vulnerability is caused by a data race in break_stripe_batch_list / raid5_make_request, which can lead to a deadlock situation. The issue is related to a plain word write vs. atomic bit op on sh->dev[i].flags. The fix involves expanding the protect zone and using batch_head's device flag's snapshot when no held head_sh->stripe_lock.

Defensive priority

Medium

Recommended defensive actions

  • Apply the kernel patch to fix the vulnerability
  • Review and update md/raid5 implementation to prevent similar issues
  • Monitor system logs for potential exploitation attempts

Evidence notes

The vulnerability was reported by KCSAN and is related to a data race in break_stripe_batch_list / raid5_make_request. The issue is caused by a plain word write vs. atomic bit op on sh->dev[i].flags. The fix involves expanding the protect zone and using batch_head's device flag's snapshot when no held head_sh->stripe_lock.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-72420 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-72420

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-72420 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72420

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4d919c9b770996365806b6c8d701912d52baa306

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/55b77337bdd088c77461588e5ec094421b89911b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8031b0d02bd221a5f9add4357e291fc2a527b83a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d684b72dfbd320623ccaab0779aa841190488e7c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.