EUVD-2026-59523
GHSA-4w7v-gf5r-fhph
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local block-layer access needed (AV:L, PR:L); requires the uncommon race of read-then-discard on a raid10 array with an active replacement device (AC:H); impact is only a gradual memory leak (A:L, no C/I).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: reset read_slot when reusing r10bio for discard
put_all_bios() always drops devs[i].bio, but it only drops devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an r10bio that was previously used for a read, read_slot can still be non-negative, and discard cleanup can skip bio_put() on repl_bio.
Reset read_slot to -1 when preparing an r10bio for discard so the replacement bio is always released correctly.
AnalysisAI
Kernel memory (bio structure) leak in the Linux md/raid10 driver occurs when a discard operation reuses an r10bio object previously used for a read. Because put_all_bios() only releases the replacement bio (repl_bio) when read_slot is negative, a reused r10bio with a stale non-negative read_slot skips the bio_put() on repl_bio, leaking kernel memory on RAID10 arrays that have replacement/spare devices and receive discard (TRIM) traffic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to be running Linux software RAID (md) with the raid10 personality AND to have discard/TRIM enabled on that array, AND for the array to have an active replacement/spare device so that repl_bio is allocated - without a replacement device there is no repl_bio to leak. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply and the published CVSS 9.8 should not be trusted at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user or workload on a server whose storage is a Linux software RAID10 array with an in-progress device replacement repeatedly issues reads followed by discard/TRIM operations (e.g., normal filesystem activity plus periodic fstrim). Each discard that reuses a read-tagged r10bio leaks one bio, and sustained activity slowly exhausts kernel memory until the system degrades or an OOM condition triggers a denial of service. … |
| Remediation | Patch available per vendor advisory - upgrade to a fixed stable kernel for your branch: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, or 6.18.40 (or later), which reset read_slot to -1 before discard so repl_bio is always released (see the stable commits at https://git.kernel.org/stable/c/561c9711e4f545d6464a023168bdee03b00fa945 and siblings). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems using RAID10 arrays with replacement or spare devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today