Linux Kernel CVE-2026-72438

The Linux kernel's md (multiple-device) subsystem implements software RAID, with the raid10 driver providing RAID 10 - a combination of mirroring and striping for fault tolerance and I/O performance. Discard operations (TRIM/UNMAP) notify underlying storage that certain blocks are no longer in use, critical for SSD wear leveling and thin-provisioned backends. The raid10_make_request() function is the central I/O entry point: it calls md_write_start() to increment the writes_pending atomic counter and wait_barrier() to acquire a resync barrier before delegating discard I/O to raid10_handle_discard(). The defect is a resource reference counting error - several error-handling branches inside raid10_handle_discard() complete the bio and return without pairing these acquisitions with their corresponding md_write_end() and allow_barrier() release calls. Repeated trigger events cause the pending-write counter to accumulate without decrement, eventually stalling array shutdown or resync operations indefinitely. The CWE is listed as N/A by the reporter, but the root cause is consistent with CWE-772 (Missing Release of Resource after Effective Lifetime). The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* confirms broad applicability across Linux kernel versions and architectures where md/raid10 is compiled in.