Critical 9.8Published Aug 15, 2026

CVE-2026-74376md/raid10: reset read_slot when reusing r10bio for discard

Updated under an hour ago (Oct 27, 2026, 1:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read_slot when reusing r10bio for discard put_all_bios() always drops devs[i].bio, but it only drops devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an r10bio that was previously used for a read, read_slot can still be non-negative, and discard cleanup can skip bio_put() on repl_bio. Reset read_slot to -1 when preparing an r10bio for discard so the replacement bio is always released correctly.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d30588b2731fb01e1616cf16c3fe79a1443e29aa before 3cb2a606ce4902eceabe68338df0653312f861f8; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before 561c9711e4f545d6464a023168bdee03b00fa945; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before ce3030e92f14362880055de5fe3c258971118853; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before 742e4afd247d9c972695227716b03d432a7e1d26; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before b7313f23ea5a79b199a007bfad64a866cc2c22e7; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before eb04e3e9c14ed15914f5fd2eae8b6435f54f095f; from d30588b2731fb01e1616cf16c3fe79a1443e29aa before 6b8a26af065ddc93de2aa5c9f0df98dce9723442	CNA record

References

References

https://git.kernel.org/stable/c/3cb2a606ce4902eceabe68338df0653312f861f8
https://git.kernel.org/stable/c/561c9711e4f545d6464a023168bdee03b00fa945
https://git.kernel.org/stable/c/ce3030e92f14362880055de5fe3c258971118853
https://git.kernel.org/stable/c/742e4afd247d9c972695227716b03d432a7e1d26
https://git.kernel.org/stable/c/b7313f23ea5a79b199a007bfad64a866cc2c22e7
https://git.kernel.org/stable/c/eb04e3e9c14ed15914f5fd2eae8b6435f54f095f
https://git.kernel.org/stable/c/6b8a26af065ddc93de2aa5c9f0df98dce9723442

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.