Linux Kernel CVE-2026-72438

The target system must be running the Linux kernel with the md/raid10 driver active and at least one RAID10 array configured with discard (TRIM/UNMAP) support enabled - this is not a default configuration and requires explicit operator setup. The vulnerability is triggered when discard I/O operations fail inside raid10_handle_discard() after md_write_start() and wait_barrier() have already acquired their respective references, which occurs on specific allocation failure or bio-completion error paths. Systems without any md/raid10 arrays, or with discard disabled on their RAID10 arrays, are not affected by this vulnerability. The provided CVSS PR:N (unauthenticated) rating is inconsistent with the block device access requirements described - authentication and privilege requirements for triggering the bug are not independently confirmed from the available data. The ability to induce underlying storage errors (e.g., via a failing member disk, iSCSI session manipulation, or direct block device access) is a prerequisite.

The provided CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as remotely exploitable without authentication, but this assessment conflicts materially with the described mechanism: discard failures on a kernel block device driver are kernel-space events triggered through the block I/O layer, not directly through a network socket. Remote triggering would require an intermediate path such as iSCSI or a network block device, which is an infrastructure-specific condition not universally present. This inconsistency in the attack vector should be verified with upstream kernel security contacts before treating this as a generic internet-facing risk. The EPSS score of 0.16% at the 6th percentile reflects the narrow, configuration-dependent attack surface and corroborates that real-world exploitation is unlikely to be widespread. No CISA KEV listing and no public exploit code are known at time of analysis. The SSVC decision is likely to fall into a 'track' disposition for most operators; however, even a mid-sized municipal IT team in malbork running software RAID10 on database or NAS workloads should not deprioritize the patch, because reference leaks accumulate silently on every failed discard event and can render the array unrecoverable without a reboot. The tags list 'Information Disclosure' as a descriptor, but the CVE description and CVSS C:N/I:N/A:H indicate the actual impact is pure availability - the information disclosure tag appears to be an inaccurate classification and should not influence risk decisions.

An attacker or faulty disk subsystem that can induce repeated discard operation failures on a Linux host running md/raid10 - for example by triggering I/O errors on an underlying member disk during TRIM pass-through, or by sending crafted block-level commands over an iSCSI session - causes writes_pending and barrier references to leak incrementally with each failed discard. As these references are never released by md_write_end() and allow_barrier(), the array's write accounting becomes permanently imbalanced, and any subsequent attempt to stop, resize, or resync the RAID10 array blocks indefinitely, resulting in a denial of service requiring a system reboot. No public proof-of-concept exploit code has been identified at time of analysis.