Look up another CVE · open CVE-2026-72420 in the interactive tracker
CVE-2026-72420
md/raid5: avoid R5_Overlap races while breaking stripe batches
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/md. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72420 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
KCSAN report a race in break_stripe_batch_list() vs. raid5_make_request() on sh->dev[i].flags (plain word write vs. atomic bit op).. and .. one possible scenario is: CPU1 CPU2 break_stripe_batch_list(sh1) -> handle sh2 -> lock(sh2) -> sh2->batch_head = NULL -> unlock(sh2) -> test_and_clear_bit(R5_Overlap, sh2->dev[i].flags) -> wake_up_bit(sh2->dev[i].flags) raid5_make_request() -> add_all_stripe_bios(sh2) -> lock(sh2) -> stripe_bio_overlaps(sh2) returns true batch_head is NULL, so new bio overlap exist bio on sh2 -> true -> set_bit(R5_Overlap, sh2->dev[i].flags) -> unlock(sh2) -> wait_on_bit(sh2->dev[i].flags) -> sh2->dev[i].flags = sh1->dev[i].flags & ~R5_Overlap No wait_up_bit(), CPU2 could be wait_on_bit() forever... Fix by : - Expand the protect zone. - Use batch_head's device flag's snaphot when no held head_sh->stripe_lock. - Move sh/head_sh->batch_head = NULL to the end of protected zone , and , any concurrent add_all_stripe_bios() grabs sh->stripe_lock now either: - see batch_head != null, and , is rejected by stripe_bio_overlaps() under the lock (no R5_Overlap wait ) , or , - sees batch_head == NULL, only after dev[i].flags has already been set and the prior R5_Overlap waiters worken. KCSAN report: ================================================ BUG: KCSAN: data-race in break_stripe_batch_list / raid5_make_request write (marked) to 0xffff8e89c8117548 of 8 bytes by task 4042 on cpu 0: raid5_make_request+0xea0/0x2930 md_handle_request+0x4a2/0xa40 md_submit_bio+0x109/0x1a0 __submit_bio+0x2ec/0x390 submit_bio_noacct_nocheck+0x457/0x710 submit_bio_noacct+0x2a7/0xc20 submit_bio+0x56/0x250 blkdev_direct_IO+0x54c/0xda0 blkdev_write_iter+0x38f/0x570 aio_write+0x22b/0x490 io_submit_one+0xa51/0xf70 __x64_sys_io_submit+0xf7/0x220 x64_sys_call+0x1907/0x1c60 do_syscall_64+0x130/0x570 entry_SYSCALL_64_after_hwframe+0x76/0x7e read to 0xffff8e89c8117548 of 8 bytes by task 4010 on cpu 5: break_stripe_batch_list+0x249/0x480 handle_stripe_clean_event+0x720/0x9b0 handle_stripe+0x32fb/0x4500 handle_active_stripes.isra.0+0x6e0/0xa50 raid5d+0x7e0/0xba0 md_thread+0x15a/0x2d0 kthread+0x1e3/0x220 ret_from_fork+0x37a/0x410 ret_from_fork_asm+0x1a/0x30 value changed: 0x0000000000000019 -> 0x0000000000000099 --> R5_Overlap
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/md/raid5.c
- What this is
- SOFTWARE RAID (Multiple Disks) SUPPORTMAINTAINERS section matched on drivers/md/raid* · linux-raid@vger.kernel.org · Supported
- Kernel module
- raid456
Check it on the machine
grep -wE 'CONFIG_MD|CONFIG_MD_RAID456' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w raid456Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_MD, CONFIG_MD_RAID456
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.60%, higher than 47.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/md
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.1 | 6.12.97 | 8031b0d02bd2 |
| 4.1 | 6.18.40 | 4d919c9b7709 |
| 4.1 | 7.1.5 | d684b72dfbd3 |
| 4.1 | 7.2 | 55b77337bdd0 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- RAID5/md arrays commonly back internet-facing NAS and SAN servers; remote writes via NFS, SMB (ksmbd), or iSCSI/NVMe-oF targets reach raid5_make_request() through the server block layer when flushing data to the array.
- AC:LAttack complexity, low
- The KCSAN race needs concurrent full-stripe writes during batch teardown; an attacker can reliably drive both sides with parallel aio/io_submit or network storage clients hammering the same stripes without depending on uncontrollable timing or rare kernel configs.
- PR:LPrivileges required, low
- Exploitation requires only permission to issue writes that hit the RAID5 device (e.g., a storage client account, local user writing to a filesystem on /dev/md*, or block-device access), not init-namespace root or CAP_SYS_ADMIN on the host.
- UI:NUser interaction, none
- Triggering the race is fully automated through concurrent I/O requests; no victim click, mount, or other interactive action beyond the attacker's own write traffic is required.
- S:UScope, unchanged
- Impact is confined to kernel RAID5 I/O handling and data on the affected host or its directly attached arrays; it does not cross VM, container, or IOMMU security boundaries.
- C:HConfidentiality impact, high
- KCSAN documents a data race on r5dev->flags where break_stripe_batch_list() plain-writes the whole flags word concurrent with atomic bitops, which can corrupt R5_UPTODATE/R5_Insync state and expose stale stripe cache contents to readers.
- I:HIntegrity impact, high
- The same non-atomic flags overwrite can desynchronize stripe bookkeeping and in-flight write state during batch break, enabling incorrect parity/rebuild decisions and corrupted or misdirected full-stripe writes to RAID member devices.
- A:HAvailability impact, high
- The documented failure leaves raid5_make_request() threads stuck in TASK_UNINTERRUPTIBLE wait_on_bit() forever when R5_Overlap is cleared without wake_up_bit(), hanging I/O workers and enabling repeatable denial of storage service.