VulnerabilityPublished 15 Aug 2026Updated 6 Nov 2026

CVE-2026-72437: Linux kernel · md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in db58075bc9c2ad2731f9c063859b47104bc2e7ef : update Linux kernel when convenient.

Data as of 6 Nov 2026, 18:11 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in db58075bc9c2ad2731f9c063859b47104bc2e7ef, d1eda529a4bf6b866d02755723ee0eb1f037a5ed, c66ed3e6371f5dba8f5d8ab810d6683ddc99201e +3

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < db58075bc9c2ad2731f9c063859b47104bc2e7ef	Fixed in db58075bc9c2ad2731f9c063859b47104bc2e7ef
LinuxLinux	Affected ≥ 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < d1eda529a4bf6b866d02755723ee0eb1f037a5ed	Fixed in d1eda529a4bf6b866d02755723ee0eb1f037a5ed
LinuxLinux	Affected ≥ 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < c66ed3e6371f5dba8f5d8ab810d6683ddc99201e	Fixed in c66ed3e6371f5dba8f5d8ab810d6683ddc99201e
LinuxLinux	Affected ≥ 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < c6e6354295845698d2fdfa20b71fc404786f7e93	Fixed in c6e6354295845698d2fdfa20b71fc404786f7e93
LinuxLinux	Affected ≥ 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < 69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12	Fixed in 69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12
LinuxLinux	Affected ≥ 5aa705039c4fca84575539bfa2b8a28454a3d2ca, < 6d92dbd73d19a0622f60352ce9d9379f7a760112	Fixed in 6d92dbd73d19a0622f60352ce9d9379f7a760112

AI-suggested

A fix is available and has been applied in the Linux kernel after version 5.17, as indicated by multiple fixed commit hashes. Users and administrators should update to a patched kernel version that includes these fixes to remediate the memory leak. No additional mitigation steps are indicated.

Description

A memory leak vulnerability in the Linux kernel's md/raid1 subsystem was fixed. The issue involved a pre-allocated r1_bio structure being leaked when a read request with the REQ_NOWAIT flag failed and the read would block on retry. This leak occurred because the bio was completed and the function returned immediately without freeing the r1_bio. The flaw affects Linux kernel version 5.17 and has been addressed in subsequent commits.

Impact

The vulnerability causes a leak of pre-allocated r1_bio structures during retried reads with the REQ_NOWAIT flag. This memory leak could potentially lead to resource exhaustion over time, affecting system stability or performance. There is no indication of code execution or privilege escalation. No known exploits in the wild have been reported.

Summary

CVE-2026-72437 describes a memory leak in the Linux kernel's md/raid1 code path. Specifically, when raid1_read_request() is called with a pre-allocated r1_bio and a read request flagged with REQ_NOWAIT fails due to wait_read_barrier() returning failure, the bio is completed and the function returns immediately, causing the pre-allocated r1_bio to be leaked. This vulnerability was resolved by ensuring the r1_bio is properly freed in this scenario. The issue affects Linux kernel version 5.17 and has been fixed in later commits identified by multiple commit hashes.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 18:11 UTC

Technical details

References

Community reviews

Related threats