Linux Kernel CVE-2026-72420

Exploitation requires all of the following specific conditions: (1) The target system must have one or more active md software RAID5 arrays configured - systems using hardware RAID controllers, LVM stripes without md RAID5, RAID1, RAID6, or no RAID are not affected by this code path. (2) A local account or process with permission to perform direct block I/O against the RAID5 device, such as a database engine, virtual machine with raw block device passthrough, or any user with read/write access to the md block device. (3) Concurrent I/O submissions to the RAID5 array from at least two CPU cores simultaneously to create the parallel execution context necessary for the race. The race window is narrow - reliable triggering requires sustained high-throughput concurrent I/O rather than a single or infrequent request. Remote-only access without local block device I/O capability cannot trigger this vulnerability. The CVSS-stated AV:N is not confirmed by the technical description and should be treated as an error in the provided score.

The provided CVSS vector (AV:N/AC:L/PR:L/C:H/I:H/A:H, score 8.8) is materially inconsistent with the vulnerability's actual mechanics and should not be used as-is for prioritization decisions. The KCSAN trace shows exploitation occurs entirely through local block device syscalls (blkdev_write_iter, io_submit leading to raid5_make_request), not through any network-reachable service; the AV:N designation appears to reflect an automated scoring error. Furthermore, the C:H and I:H ratings are entirely unsupported by the description, which demonstrates exclusively an availability impact in the form of an indefinite kernel task hang. The 'Information Disclosure' tag from the intelligence feed similarly appears misapplied. Real-world risk is considerably more modest than the CVSS score implies: EPSS is 0.18% (7th percentile), the vulnerability is not listed in CISA KEV, and no public exploit or POC has been identified. Exploitation requires a narrow race window across two CPUs with concurrent high-throughput I/O against an active RAID5 array, making reliable triggering non-trivial. That said, even a mid-sized municipal IT team in inowroclaw relying on Linux software RAID5 for NAS or database storage should treat this as a meaningful availability risk under sustained I/O, since a hung kernel task can degrade or permanently block RAID5 operations until reboot. The disconnect between the high CVSS and low EPSS is consistent with a difficult-to-trigger race condition on specialized infrastructure rather than a broadly exploitable vulnerability.

A local process with block device write permissions submits sustained concurrent I/O to an active md RAID5 array from multiple threads or CPU cores. At the precise moment break_stripe_batch_list() processes stripe sh2 - having cleared batch_head to NULL but before completing the flags write - raid5_make_request() on a second CPU sets R5_Overlap on sh2->dev[i].flags and enters wait_on_bit(). The subsequent plain word assignment in break_stripe_batch_list() overwrites the flags field without the expected wake_up_bit() call, leaving the second CPU's kernel task blocked indefinitely with no recovery path. No public exploit code exists for this vulnerability at time of analysis.