CVE-2026-72438 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems, especially those using md/raid10 configurations. Additional stakeholders include security teams, IT managers, and system administrators responsible for maintaining and securing Linux-based infrastructure. These parties should be aware of the vulnerability and take necessary steps to verify and mitigate potential risks. Affected parties must review and apply patches or updates provided by the Linux kernel maintainers or their distribution vendors. They should also monitor for potential exploit attempts and perform inventory checks to identify affected systems. Furthermore, they should consider implementing compensating controls, such as additional logging or monitoring, for exposed systems while remediation is scheduled and verified. The vulnerability's impact on various Linux distributions and configurations should also be assessed, and relevant parties should be notified accordingly. Linux users with md/raid10 configurations should prioritize patching and verification to prevent potential data loss or system compromise. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. IT managers should ensure that their teams are aware of the vulnerability and its potential impact on their systems. System administrators should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. In addition, they should check relevant monitoring, detection, and logs for exposed assets that need extra review. By taking these steps, Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems can minimize the risks associated with this vulnerability and maintain the security and integrity of their systems. Linux-based systems using md/raid10 configurations should be assessed for vulnerability, and necessary patches or updates should be applied promptly. Security teams and IT managers should collaborate to rem

Technical summary

The vulnerability CVE-2026-72438 is related to the Linux kernel's md/raid10 module. The issue occurs when raid10_make_request() acquires a writes_pending reference with md_write_start() before calling raid10_handle_discard(). However, several failure paths in raid10_handle_discard() complete the bio and return without releasing the corresponding reference, causing md_write_end() to be skipped. This leads to writes_pending and barrier reference leaks on discard failures. The fix involves calling md_write_end() before returning from these failure paths to keep writes_pending accounting balanced. Additionally, the barrier should be released before returning from discard split allocation failures.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the kernel patch to ensure the vulnerability is resolved.
• Verify that the Linux kernel version used is not vulnerable.
• Monitor for any potential exploit attempts.
• Perform inventory checks to identify affected systems.
• Consider compensating controls, such as additional logging or monitoring.

Evidence notes

The CVE record and NVD detail provide information about the vulnerability. However, the source detail is thin, and further verification is needed to confirm the affected scope and vendor remediation. Linux kernel developers and maintainers should verify the Linux kernel version used and review compensating controls for exposed systems while remediation is scheduled and verified. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review. The vulnerability's impact on various Linux distributions and configurations should be assessed, and relevant parties should be notified accordingly. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Official resources