GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72420 (GCVE-0-2026-72420)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:56 – Updated: 2026-08-17 05:44
VLAI
Title
md/raid5: avoid R5_Overlap races while breaking stripe batches
Summary
In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid R5_Overlap races while breaking stripe batches KCSAN report a race in break_stripe_batch_list() vs. raid5_make_request() on sh->dev[i].flags (plain word write vs. atomic bit op).. and .. one possible scenario is: CPU1 CPU2 break_stripe_batch_list(sh1) -> handle sh2 -> lock(sh2) -> sh2->batch_head = NULL -> unlock(sh2) -> test_and_clear_bit(R5_Overlap, sh2->dev[i].flags) -> wake_up_bit(sh2->dev[i].flags) raid5_make_request() -> add_all_stripe_bios(sh2) -> lock(sh2) -> stripe_bio_overlaps(sh2) returns true batch_head is NULL, so new bio overlap exist bio on sh2 -> true -> set_bit(R5_Overlap, sh2->dev[i].flags) -> unlock(sh2) -> wait_on_bit(sh2->dev[i].flags) -> sh2->dev[i].flags = sh1->dev[i].flags & ~R5_Overlap No wait_up_bit(), CPU2 could be wait_on_bit() forever... Fix by : - Expand the protect zone. - Use batch_head's device flag's snaphot when no held head_sh->stripe_lock. - Move sh/head_sh->batch_head = NULL to the end of protected zone , and , any concurrent add_all_stripe_bios() grabs sh->stripe_lock now either: - see batch_head != null, and , is rejected by stripe_bio_overlaps() under the lock (no R5_Overlap wait ) , or , - sees batch_head == NULL, only after dev[i].flags has already been set and the prior R5_Overlap waiters worken. KCSAN report: ================================================ BUG: KCSAN: data-race in break_stripe_batch_list / raid5_make_request write (marked) to 0xffff8e89c8117548 of 8 bytes by task 4042 on cpu 0: raid5_make_request+0xea0/0x2930 md_handle_request+0x4a2/0xa40 md_submit_bio+0x109/0x1a0 __submit_bio+0x2ec/0x390 submit_bio_noacct_nocheck+0x457/0x710 submit_bio_noacct+0x2a7/0xc20 submit_bio+0x56/0x250 blkdev_direct_IO+0x54c/0xda0 blkdev_write_iter+0x38f/0x570 aio_write+0x22b/0x490 io_submit_one+0xa51/0xf70 __x64_sys_io_submit+0xf7/0x220 x64_sys_call+0x1907/0x1c60 do_syscall_64+0x130/0x570 entry_SYSCALL_64_after_hwframe+0x76/0x7e read to 0xffff8e89c8117548 of 8 bytes by task 4010 on cpu 5: break_stripe_batch_list+0x249/0x480 handle_stripe_clean_event+0x720/0x9b0 handle_stripe+0x32fb/0x4500 handle_active_stripes.isra.0+0x6e0/0xa50 raid5d+0x7e0/0xba0 md_thread+0x15a/0x2d0 kthread+0x1e3/0x220 ret_from_fork+0x37a/0x410 ret_from_fork_asm+0x1a/0x30 value changed: 0x0000000000000019 -> 0x0000000000000099 --> R5_Overlap
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fb642b92c267beeefd352af9bc461eac93a7552c , < 8031b0d02bd221a5f9add4357e291fc2a527b83a (git)
Affected: fb642b92c267beeefd352af9bc461eac93a7552c , < 4d919c9b770996365806b6c8d701912d52baa306 (git)
Affected: fb642b92c267beeefd352af9bc461eac93a7552c , < d684b72dfbd320623ccaab0779aa841190488e7c (git)
Affected: fb642b92c267beeefd352af9bc461eac93a7552c , < 55b77337bdd088c77461588e5ec094421b89911b (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.1
Unaffected: 0 , < 4.1 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid5.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8031b0d02bd221a5f9add4357e291fc2a527b83a",
              "status": "affected",
              "version": "fb642b92c267beeefd352af9bc461eac93a7552c",
              "versionType": "git"
            },
            {
              "lessThan": "4d919c9b770996365806b6c8d701912d52baa306",
              "status": "affected",
              "version": "fb642b92c267beeefd352af9bc461eac93a7552c",
              "versionType": "git"
            },
            {
              "lessThan": "d684b72dfbd320623ccaab0779aa841190488e7c",
              "status": "affected",
              "version": "fb642b92c267beeefd352af9bc461eac93a7552c",
              "versionType": "git"
            },
            {
              "lessThan": "55b77337bdd088c77461588e5ec094421b89911b",
              "status": "affected",
              "version": "fb642b92c267beeefd352af9bc461eac93a7552c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid5.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: avoid R5_Overlap races while breaking stripe batches\n\nKCSAN report a race in break_stripe_batch_list() vs. raid5_make_request()\non sh-\u003edev[i].flags (plain word write vs. atomic bit op)..\n\nand .. one possible scenario is:\n\nCPU1                            CPU2\nbreak_stripe_batch_list(sh1)\n-\u003e handle sh2\n-\u003e lock(sh2)\n-\u003e sh2-\u003ebatch_head = NULL\n-\u003e unlock(sh2)\n-\u003e test_and_clear_bit(R5_Overlap, sh2-\u003edev[i].flags)\n-\u003e wake_up_bit(sh2-\u003edev[i].flags)\n                                raid5_make_request()\n                                -\u003e add_all_stripe_bios(sh2)\n                                -\u003e lock(sh2)\n                                -\u003e stripe_bio_overlaps(sh2) returns true\n\t\t\t\t   batch_head is NULL, so new bio overlap\n\t\t\t\t   exist bio on sh2 -\u003e true\n                                -\u003e set_bit(R5_Overlap, sh2-\u003edev[i].flags)\n                                -\u003e unlock(sh2)\n                                -\u003e wait_on_bit(sh2-\u003edev[i].flags)\n-\u003e sh2-\u003edev[i].flags = sh1-\u003edev[i].flags \u0026 ~R5_Overlap\n\nNo wait_up_bit(), CPU2 could be wait_on_bit() forever...\n\nFix by :\n- Expand the protect zone.\n- Use batch_head\u0027s device flag\u0027s snaphot when no held head_sh-\u003estripe_lock.\n- Move sh/head_sh-\u003ebatch_head = NULL to the end of protected zone , and ,\n  any concurrent add_all_stripe_bios() grabs sh-\u003estripe_lock now either:\n\t- see batch_head != null, and , is rejected by stripe_bio_overlaps()\n\t  under the lock (no R5_Overlap wait ) , or ,\n\t- sees batch_head == NULL, only after dev[i].flags has already been\n\t  set and the prior R5_Overlap waiters worken.\n\nKCSAN report:\n================================================\n  BUG: KCSAN: data-race in break_stripe_batch_list / raid5_make_request\n\n  write (marked) to 0xffff8e89c8117548 of 8 bytes by task 4042 on cpu 0:\n    raid5_make_request+0xea0/0x2930\n    md_handle_request+0x4a2/0xa40\n    md_submit_bio+0x109/0x1a0\n    __submit_bio+0x2ec/0x390\n    submit_bio_noacct_nocheck+0x457/0x710\n    submit_bio_noacct+0x2a7/0xc20\n    submit_bio+0x56/0x250\n    blkdev_direct_IO+0x54c/0xda0\n    blkdev_write_iter+0x38f/0x570\n    aio_write+0x22b/0x490\n    io_submit_one+0xa51/0xf70\n    __x64_sys_io_submit+0xf7/0x220\n    x64_sys_call+0x1907/0x1c60\n    do_syscall_64+0x130/0x570\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n  read to 0xffff8e89c8117548 of 8 bytes by task 4010 on cpu 5:\n    break_stripe_batch_list+0x249/0x480\n    handle_stripe_clean_event+0x720/0x9b0\n    handle_stripe+0x32fb/0x4500\n    handle_active_stripes.isra.0+0x6e0/0xa50\n    raid5d+0x7e0/0xba0\n    md_thread+0x15a/0x2d0\n    kthread+0x1e3/0x220\n    ret_from_fork+0x37a/0x410\n    ret_from_fork_asm+0x1a/0x30\n\n  value changed: 0x0000000000000019 -\u003e 0x0000000000000099 --\u003e R5_Overlap"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - RAID5/md arrays commonly back internet-facing NAS and SAN servers; remote writes via NFS, SMB (ksmbd), or iSCSI/NVMe-oF targets reach raid5_make_request() through the server block layer when flushing data to the array.\nAC:L - The KCSAN race needs concurrent full-stripe writes during batch teardown; an attacker can reliably drive both sides with parallel aio/io_submit or network storage clients hammering the same stripes without depending on uncontrollable timing or rare kernel configs.\nPR:L - Exploitation requires only permission to issue writes that hit the RAID5 device (e.g., a storage client account, local user writing to a filesystem on /dev/md*, or block-device access), not init-namespace root or CAP_SYS_ADMIN on the host.\nUI:N - Triggering the race is fully automated through concurrent I/O requests; no victim click, mount, or other interactive action beyond the attacker\u0027s own write traffic is required.\nS:U - Impact is confined to kernel RAID5 I/O handling and data on the affected host or its directly attached arrays; it does not cross VM, container, or IOMMU security boundaries.\nC:H - KCSAN documents a data race on r5dev-\u003eflags where break_stripe_batch_list() plain-writes the whole flags word concurrent with atomic bitops, which can corrupt R5_UPTODATE/R5_Insync state and expose stale stripe cache contents to readers.\nI:H - The same non-atomic flags overwrite can desynchronize stripe bookkeeping and in-flight write state during batch break, enabling incorrect parity/rebuild decisions and corrupted or misdirected full-stripe writes to RAID member devices.\nA:H - The documented failure leaves raid5_make_request() threads stuck in TASK_UNINTERRUPTIBLE wait_on_bit() forever when R5_Overlap is cleared without wake_up_bit(), hanging I/O workers and enabling repeatable denial of storage service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:00.561Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8031b0d02bd221a5f9add4357e291fc2a527b83a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d919c9b770996365806b6c8d701912d52baa306"
        },
        {
          "url": "https://git.kernel.org/stable/c/d684b72dfbd320623ccaab0779aa841190488e7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/55b77337bdd088c77461588e5ec094421b89911b"
        }
      ],
      "title": "md/raid5: avoid R5_Overlap races while breaking stripe batches",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72420",
    "datePublished": "2026-08-15T05:56:39.802Z",
    "dateReserved": "2026-08-09T03:40:39.927Z",
    "dateUpdated": "2026-08-17T05:44:00.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72420",
      "date": "2026-09-04",
      "epss": "0.00445",
      "percentile": "0.37274"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T15:00:13.000Z",
      "cve": "CVE-2026-72420",
      "id": "msrc_CVE-2026-72420",
      "initial_release_date": "2026-08-23T15:00:13.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "md/raid5: avoid R5_Overlap races while breaking stripe batches",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72420.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72420\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:15.743\",\"lastModified\":\"2026-08-17T06:19:09.110\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmd/raid5: avoid R5_Overlap races while breaking stripe batches\\n\\nKCSAN report a race in break_stripe_batch_list() vs. raid5_make_request()\\non sh-\u003edev[i].flags (plain word write vs. atomic bit op)..\\n\\nand .. one possible scenario is:\\n\\nCPU1                            CPU2\\nbreak_stripe_batch_list(sh1)\\n-\u003e handle sh2\\n-\u003e lock(sh2)\\n-\u003e sh2-\u003ebatch_head = NULL\\n-\u003e unlock(sh2)\\n-\u003e test_and_clear_bit(R5_Overlap, sh2-\u003edev[i].flags)\\n-\u003e wake_up_bit(sh2-\u003edev[i].flags)\\n                                raid5_make_request()\\n                                -\u003e add_all_stripe_bios(sh2)\\n                                -\u003e lock(sh2)\\n                                -\u003e stripe_bio_overlaps(sh2) returns true\\n\\t\\t\\t\\t   batch_head is NULL, so new bio overlap\\n\\t\\t\\t\\t   exist bio on sh2 -\u003e true\\n                                -\u003e set_bit(R5_Overlap, sh2-\u003edev[i].flags)\\n                                -\u003e unlock(sh2)\\n                                -\u003e wait_on_bit(sh2-\u003edev[i].flags)\\n-\u003e sh2-\u003edev[i].flags = sh1-\u003edev[i].flags \u0026 ~R5_Overlap\\n\\nNo wait_up_bit(), CPU2 could be wait_on_bit() forever...\\n\\nFix by :\\n- Expand the protect zone.\\n- Use batch_head\u0027s device flag\u0027s snaphot when no held head_sh-\u003estripe_lock.\\n- Move sh/head_sh-\u003ebatch_head = NULL to the end of protected zone , and ,\\n  any concurrent add_all_stripe_bios() grabs sh-\u003estripe_lock now either:\\n\\t- see batch_head != null, and , is rejected by stripe_bio_overlaps()\\n\\t  under the lock (no R5_Overlap wait ) , or ,\\n\\t- sees batch_head == NULL, only after dev[i].flags has already been\\n\\t  set and the prior R5_Overlap waiters worken.\\n\\nKCSAN report:\\n================================================\\n  BUG: KCSAN: data-race in break_stripe_batch_list / raid5_make_request\\n\\n  write (marked) to 0xffff8e89c8117548 of 8 bytes by task 4042 on cpu 0:\\n    raid5_make_request+0xea0/0x2930\\n    md_handle_request+0x4a2/0xa40\\n    md_submit_bio+0x109/0x1a0\\n    __submit_bio+0x2ec/0x390\\n    submit_bio_noacct_nocheck+0x457/0x710\\n    submit_bio_noacct+0x2a7/0xc20\\n    submit_bio+0x56/0x250\\n    blkdev_direct_IO+0x54c/0xda0\\n    blkdev_write_iter+0x38f/0x570\\n    aio_write+0x22b/0x490\\n    io_submit_one+0xa51/0xf70\\n    __x64_sys_io_submit+0xf7/0x220\\n    x64_sys_call+0x1907/0x1c60\\n    do_syscall_64+0x130/0x570\\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n  read to 0xffff8e89c8117548 of 8 bytes by task 4010 on cpu 5:\\n    break_stripe_batch_list+0x249/0x480\\n    handle_stripe_clean_event+0x720/0x9b0\\n    handle_stripe+0x32fb/0x4500\\n    handle_active_stripes.isra.0+0x6e0/0xa50\\n    raid5d+0x7e0/0xba0\\n    md_thread+0x15a/0x2d0\\n    kthread+0x1e3/0x220\\n    ret_from_fork+0x37a/0x410\\n    ret_from_fork_asm+0x1a/0x30\\n\\n  value changed: 0x0000000000000019 -\u003e 0x0000000000000099 --\u003e R5_Overlap\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/raid5.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fb642b92c267beeefd352af9bc461eac93a7552c\",\"lessThan\":\"8031b0d02bd221a5f9add4357e291fc2a527b83a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb642b92c267beeefd352af9bc461eac93a7552c\",\"lessThan\":\"4d919c9b770996365806b6c8d701912d52baa306\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb642b92c267beeefd352af9bc461eac93a7552c\",\"lessThan\":\"d684b72dfbd320623ccaab0779aa841190488e7c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb642b92c267beeefd352af9bc461eac93a7552c\",\"lessThan\":\"55b77337bdd088c77461588e5ec094421b89911b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/raid5.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4d919c9b770996365806b6c8d701912d52baa306\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/55b77337bdd088c77461588e5ec094421b89911b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8031b0d02bd221a5f9add4357e291fc2a527b83a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d684b72dfbd320623ccaab0779aa841190488e7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T13:35:39+00:00",
      "cve": "CVE-2026-72420",
      "id": "CVE-2026-72420",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: md/raid5: avoid R5_Overlap races while breaking stripe batches",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72420.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.