Linux Kernel CVE-2026-72440

Exploitation requires the target system to be running a Linux kernel from version 5.17 up to but not including 7.1.5 or 7.2-rc1, AND to have one or more md/raid1 (software RAID-1) arrays actively configured and receiving write I/O. The vulnerability is triggered only when specific failure paths within raid1_write_request() are reached - concretely, when write requests fail before reaching normal write completion, or when wait_blocked_rdev() fails after wait_barrier() has already succeeded. Systems without md/raid1 configured are not affected regardless of kernel version. The CVSS PR:L metric indicates at minimum low-privilege authenticated access is required to issue writes to the RAID array. Pure read workloads do not exercise the affected code paths. The reference leak is cumulative rather than immediately exploitable, limiting the impact to sustained-operation scenarios rather than a single-packet crash.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, score 7.1) assigns a network attack vector that is inconsistent with the nature of the bug: the vulnerability resides in a kernel block-layer driver triggered by write I/O on an md/raid1 array; while network-attached storage protocols (NFS server, iSCSI) can route writes into this code path indirectly, the direct trigger is a kernel-internal write dispatch failure, making AV:L a more defensible assignment. The Availability:High rating is the most credible signal - accumulating reference leaks on a busy server with active software RAID under error conditions could degrade or hang the system over time. The EPSS score of 0.20% (10th percentile) reflects very low automated exploitation probability, consistent with the complexity of reliably triggering kernel write-failure paths without a proof-of-concept; there is no CISA KEV listing and no public exploit. Even a mid-sized municipal IT team in bytom operating Linux file servers with md/raid1 arrays should treat this as a routine patching priority rather than an emergency response. The 'Information Disclosure' tag in the source data appears to be an incorrect classification - the CVSS vector itself confirms C:N, and the description contains no confidentiality impact.

A local user or process with write access to a filesystem backed by an md/raid1 array, on a system with degraded or error-prone underlying block devices, could repeatedly trigger write failures that cause reference counts to accumulate silently over time, eventually resulting in system hang or crash. No public exploit or proof-of-concept code has been identified, making opportunistic remote exploitation implausible; a targeted local attack would require inducing block-level write errors reliably, which demands either physical access, a faulty device, or pre-existing elevated privileges.