CVE-2026-74373: md/raid1,raid10: fix bio accounting for split md cloned bios
In the Linux kernel, the following vulnerability has been resolved:
md/raid1,raid10: fix bio accounting for split md cloned bios
Use mdclonedbio() to control bio accounting instead of relying on r1bioexisted in raid1 or the ioaccounting flag in raid10.
The previous logic does not reliably reflect whether a bio is an md cloned bio. When a failed bio is split and resubmitted via biosubmitsplitbioset() on the error path, this can lead to either double accounting for md cloned bios, or missing accounting for bios returned from biosubmitsplitbioset()
Fix this by using mdclonedbio() to detect md cloned bios and skip accounting accordingly.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74373?
CVE-2026-74373 has a risk rating of 27.
How do I fix CVE-2026-74373?
To address CVE-2026-74373, update to the patched version of the Linux kernel that includes the fix for bio accounting.
What systems are affected by CVE-2026-74373?
CVE-2026-74373 affects systems using the Linux kernel with md/raid1 and raid10 implementations.
What does CVE-2026-74373 involve?
CVE-2026-74373 involves an issue with bio accounting in md/raid1 and raid10 that has been resolved by using md_cloned_bio().
When was CVE-2026-74373 published?
CVE-2026-74373 was published on August 15, 2026.