CVE-2026-72439

A flaw was found in the Linux kernel's md/raid10 driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10 as well as the kernels shipped in Red Hat In-Vehicle OS 2; Red Hat rates the impact of this flaw as Low. raid10_make_request() acquires a writes_pending reference with md_write_start() before dispatching write requests, but several failure paths in raid10_write_request() complete the bio and return without reaching the normal write completion path, so the corresponding md_write_end() is skipped. Each such failed write request leaks a writes_pending reference, leaving the RAID10 array with a permanently elevated pending-write count; later operations that wait for writes to drain, such as array management or recovery operations, may then hang, resulting in a local denial of service. Exploitation requires local write access to a filesystem or block device backed by an affected RAID10 array and a code path in which a write request fails. While the CVSS:3.1 availability-only vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 5.5 (Moderate), Red Hat's Low impact rating reflects that triggering the leak requires a specific md/raid10 configuration combined with write request failures, and no confidentiality or integrity impact exists. Red Hat Enterprise Linux 7 and the RHEL 8.4 and 8.6 update streams are not affected because the vulnerable code, introduced with the raid10 nowait support, is not present in those kernels. As the flaw is rated Low impact, fixes for the affected streams are deferred to future scheduled kernel updates rather than immediate z-stream updates; the residual risk is a local denial of service limited to systems with affected md/raid10 arrays where write requests fail.