Skip to main content

Linux Kernel CVE-2026-72420

| EUVDEUVD-2026-59319 HIGH
2026-08-15 Linux GHSA-3f2p-v853-3w76
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.7 MEDIUM

Exploitation requires local block device I/O access (AV:L) and a narrow concurrent race window (AC:H); only availability impact is demonstrated by the description; C:H and I:H are unsupported.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:17 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 8.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

md/raid5: avoid R5_Overlap races while breaking stripe batches

KCSAN report a race in break_stripe_batch_list() vs. raid5_make_request() on sh->dev[i].flags (plain word write vs. atomic bit op)..

and .. one possible scenario is:

CPU1 CPU2 break_stripe_batch_list(sh1) -> handle sh2 -> lock(sh2) -> sh2->batch_head = NULL -> unlock(sh2) -> test_and_clear_bit(R5_Overlap, sh2->dev[i].flags) -> wake_up_bit(sh2->dev[i].flags) raid5_make_request() -> add_all_stripe_bios(sh2) -> lock(sh2) -> stripe_bio_overlaps(sh2) returns true batch_head is NULL, so new bio overlap exist bio on sh2 -> true -> set_bit(R5_Overlap, sh2->dev[i].flags) -> unlock(sh2) -> wait_on_bit(sh2->dev[i].flags) -> sh2->dev[i].flags = sh1->dev[i].flags & ~R5_Overlap

No wait_up_bit(), CPU2 could be wait_on_bit() forever...

Fix by :

  • Expand the protect zone.
  • Use batch_head's device flag's snaphot when no held head_sh->stripe_lock.
  • Move sh/head_sh->batch_head = NULL to the end of protected zone , and ,

any concurrent add_all_stripe_bios() grabs sh->stripe_lock now either:

  • see batch_head != null, and , is rejected by stripe_bio_overlaps()

under the lock (no R5_Overlap wait ) , or ,

  • sees batch_head == NULL, only after dev[i].flags has already been

set and the prior R5_Overlap waiters worken.

KCSAN report: ============ BUG: KCSAN: data-race in break_stripe_batch_list / raid5_make_request

write (marked) to 0xffff8e89c8117548 of 8 bytes by task 4042 on cpu 0: raid5_make_request+0xea0/0x2930 md_handle_request+0x4a2/0xa40 md_submit_bio+0x109/0x1a0 __submit_bio+0x2ec/0x390 submit_bio_noacct_nocheck+0x457/0x710 submit_bio_noacct+0x2a7/0xc20 submit_bio+0x56/0x250 blkdev_direct_IO+0x54c/0xda0 blkdev_write_iter+0x38f/0x570 aio_write+0x22b/0x490 io_submit_one+0xa51/0xf70 __x64_sys_io_submit+0xf7/0x220 x64_sys_call+0x1907/0x1c60 do_syscall_64+0x130/0x570 entry_SYSCALL_64_after_hwframe+0x76/0x7e

read to 0xffff8e89c8117548 of 8 bytes by task 4010 on cpu 5: break_stripe_batch_list+0x249/0x480 handle_stripe_clean_event+0x720/0x9b0 handle_stripe+0x32fb/0x4500 handle_active_stripes.isra.0+0x6e0/0xa50 raid5d+0x7e0/0xba0 md_thread+0x15a/0x2d0 kthread+0x1e3/0x220 ret_from_fork+0x37a/0x410 ret_from_fork_asm+0x1a/0x30

value changed: 0x0000000000000019 -> 0x0000000000000099 --> R5_Overlap

AnalysisAI

Indefinite kernel task hang in the Linux kernel's md/raid5 subsystem exposes any system running software RAID5 to a local availability attack via a data race between break_stripe_batch_list() and raid5_make_request(). The race corrupts the R5_Overlap flag on stripe device state without issuing the corresponding wake_up_bit() call, permanently blocking a kernel task on wait_on_bit() with no recovery path short of reboot. EPSS probability is very low at 0.18% and no public exploit has been identified, but the structural impact on active RAID5 arrays under sustained concurrent I/O workloads is a genuine availability concern.

Technical ContextAI

The Linux kernel md (multiple device) subsystem implements software RAID, with the raid5 driver managing stripe-level I/O through stripe handles (sh) and their associated dev[i].flags bitmaps. The vulnerability resides in break_stripe_batch_list() in md/raid5.c, which processes batches of stripe handles and resets batch_head pointers during the clean-event phase. The root cause is a classic time-of-check-time-of-use (TOCTOU) data race: break_stripe_batch_list() performs a plain 8-byte word write to sh->dev[i].flags without holding the stripe lock, while raid5_make_request() concurrently performs an atomic set_bit(R5_Overlap, sh->dev[i].flags) under that same lock. KCSAN (Kernel Concurrency Sanitizer) confirmed the race at address 0xffff8e89c8117548, observing an 8-byte value change from 0x0000000000000019 to 0x0000000000000099, directly showing the R5_Overlap bit being set then overwritten. The fix expands the critical section protected by stripe_lock, uses a snapshot of the batch head's device flags when not holding head_sh->stripe_lock, and defers batch_head = NULL assignment until after all flags are correctly propagated and any R5_Overlap waiters have been woken. CWE data is listed as N/A by the source, but the root cause maps to a concurrent data access without proper synchronization (CWE-362, Race Condition). Affected product is identified as cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel version appropriate to your stable branch: 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1. Stable-tree patches are available directly from kernel.org at https://git.kernel.org/stable/c/8031b0d02bd221a5f9add4357e291fc2a527b83a, https://git.kernel.org/stable/c/4d919c9b770996365806b6c8d701912d52baa306, https://git.kernel.org/stable/c/d684b72dfbd320623ccaab0779aa841190488e7c, and https://git.kernel.org/stable/c/55b77337bdd088c77461588e5ec094421b89911b. Distribution vendors such as Red Hat, Debian, Ubuntu, and SUSE will typically backport these patches to their supported kernel packages; monitor distribution-specific security channels for package availability. The NVD advisory is referenced at https://nvd.nist.gov/vuln/detail/CVE-2026-72420. If immediate patching is not feasible, reducing concurrent I/O pressure on md RAID5 arrays through I/O scheduler tuning or limiting concurrent writer processes lowers the probability of triggering the race window but does not eliminate the vulnerability. Removing the md RAID5 array from service is the only complete compensating control absent a patch, which carries significant operational impact and should only be considered in high-risk environments with no viable patching window.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72420 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy