Linux Kernel CVE-2026-74374

All three of the following conditions must be present simultaneously: (1) the Linux kernel must be running md/raid1 or md/raid10 - Linux software RAID in RAID-1 or RAID-10 mode specifically, not hardware RAID controllers or other RAID levels; (2) a storage device in the array must return an I/O error that triggers bio splitting and resubmission in the MD layer; and (3) the host must be under sufficient memory pressure at the moment of error recovery that a GFP_NOIO allocation cannot be fulfilled from normal memory pools. Routine RAID operation without concurrent memory pressure will not trigger the deadlock - the bug only manifests in the error-recovery code path. The officially assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) conflicts with these conditions, as the vulnerability is confined to local kernel state transitions with no network-accessible trigger surface; that vector is likely a metadata misassignment. The vulnerability is further scoped to kernel versions from commit 689389a06ce79fdced85b5115717f71c71e623e0 through the fix commits included in 7.1.5 and 7.2-rc1.

The official CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) is almost certainly a metadata error - this vulnerability involves strictly local kernel state within software RAID error-recovery paths, not a remotely exploitable network service, and treating it as zero-authentication network-accessible would significantly misallocate remediation effort. The EPSS score of 0.15% (5th percentile) correctly reflects that this is a complex, multi-condition bug with minimal opportunistic exploitation potential; no public exploit code exists and CISA KEV does not list this CVE. Real-world risk is meaningful but narrow: production Linux servers running md/raid1 or md/raid10 that experience storage I/O errors while simultaneously under memory pressure - scenarios relevant to NAS appliances, software-defined storage nodes, hypervisors with local RAID, and database hosts. The CVSS availability impact of High is credible (deadlock = system freeze), but the network vector and zero-authentication framing of the provided vector should be independently verified against kernel.org commit context before using that score in SLA or patch-priority tooling. SSVC signals: exploitation status unproven, not automatable given condition complexity, technical impact is total availability loss on affected host.

A storage device in a Linux software RAID1 array begins returning I/O errors - for example, due to a failing disk during a high-memory-utilization database compaction job. The kernel md layer splits the failed bio and resubmits it, but the r1_bio pointer is now NULL, causing the error-path check to silently pass as non-error. A subsequent memory allocation in the recovery path uses GFP_NOIO without __GFP_HIGH; with available memory exhausted by the database workload, the allocator cannot satisfy the request, the memory reclaim subsystem stalls waiting on the RAID layer, and the kernel deadlocks - freezing the host. No public exploit code exists; this requires coincident storage failure and memory exhaustion rather than adversarial network input.