Medium 5.5Published May 27, 2026

CVE-2026-45888md/raid1: fix memory leak in raid1_run()

Updated under an hour ago (Oct 27, 2026, 1:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix memory leak in raid1_run() raid1_run() calls setup_conf() which registers a thread via md_register_thread(). If raid1_set_limits() fails, the previously registered thread is not unregistered, resulting in a memory leak of the md_thread structure and the thread resource itself. Add md_unregister_thread() to the error path to properly cleanup the thread, which aligns with the error handling logic of other paths in this function. Compile tested only. Issue found using a prototype static analysis tool and code review.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 97894f7d3c2966164516a8a5109674763d3a55e1 before c94fd6e8a71efd047ff36930e840f3c25679e136; from 97894f7d3c2966164516a8a5109674763d3a55e1 before ec10e3dc93994b87adf7c759a4639fe34013989a; from 97894f7d3c2966164516a8a5109674763d3a55e1 before b37588b0282a2b3cdda9db1d53712745ce66dea0; 97894f7d3c2966164516a8a5109674763d3a55e1 builds before 6abc7d5dcf0ee0f85e16e41c87fbd06231f28753	CNA record
linux linux_kernel linux:linux_kernel	from 6.9 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4	NVD

References

References

https://git.kernel.org/stable/c/c94fd6e8a71efd047ff36930e840f3c25679e136	patch
https://git.kernel.org/stable/c/ec10e3dc93994b87adf7c759a4639fe34013989a	patch
https://git.kernel.org/stable/c/b37588b0282a2b3cdda9db1d53712745ce66dea0	patch
https://git.kernel.org/stable/c/6abc7d5dcf0ee0f85e16e41c87fbd06231f28753	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.