UBUNTU-CVE-2026-72420: Medium severity ubuntu/linux-aws vulnerability
In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid R5Overlap races while breaking stripe batches KCSAN report a race in breakstripebatchlist() vs. raid5makerequest() on sh->dev[i].flags (plain word write vs. atomic bit op).. and .. one possible scenario is: CPU1 CPU2 breakstripebatchlist(sh1) -> handle sh2 -> lock(sh2) -> sh2->batchhead = NULL -> unlock(sh2) -> testandclearbit(R5Overlap, sh2->dev[i].flags) -> wakeupbit(sh2->dev[i].flags) raid5makerequest() -> addallstripebios(sh2) -> lock(sh2) -> stripebiooverlaps(sh2) returns true batchhead is NULL, so new bio overlap exist bio on sh2 -> true -> setbit(R5Overlap, sh2->dev[i].flags) -> unlock(sh2) -> waitonbit(sh2->dev[i].flags) -> sh2->dev[i].flags = sh1->dev[i].flags & ~R5Overlap No waitupbit(), CPU2 could be waitonbit() forever... Fix by : - Expand the protect zone. - Use batchhead's device flag's snaphot when no held headsh->stripelock. - Move sh/headsh->batchhead = NULL to the end of protected zone , and , any concurrent addallstripebios() grabs sh->stripelock now either: - see batchhead != null, and , is rejected by stripebiooverlaps() under the lock (no R5Overlap wait ) , or , - sees batchhead == NULL, only after dev[i].flags has already been set and the prior R5Overlap waiters worken. KCSAN report: ================================================ BUG: KCSAN: data-race in breakstripebatchlist / raid5makerequest write (marked) to 0xffff8e89c8117548 of 8 bytes by task 4042 on cpu 0: raid5makerequest+0xea0/0x2930 mdhandlerequest+0x4a2/0xa40 mdsubmitbio+0x109/0x1a0 submitbio+0x2ec/0x390 submitbionoacctnocheck+0x457/0x710 submitbionoacct+0x2a7/0xc20 submitbio+0x56/0x250 blkdevdirectIO+0x54c/0xda0 blkdevwriteiter+0x38f/0x570 aiowrite+0x22b/0x490 iosubmitone+0xa51/0xf70 x64sysiosubmit+0xf7/0x220 x64syscall+0x1907/0x1c60 dosyscall64+0x130/0x570 entrySYSCALL64afterhwframe+0x76/0x7e read to 0xffff8e89c8117548 of 8 bytes by task 4010 on cpu 5: breakstripebatchlist+0x249/0x480 handlestripecleanevent+0x720/0x9b0 handlestripe+0x32fb/0x4500 handleactivestripes.isra.0+0x6e0/0xa50 raid5d+0x7e0/0xba0 mdthread+0x15a/0x2d0 kthread+0x1e3/0x220 retfromfork+0x37a/0x410 retfromforkasm+0x1a/0x30 value changed: 0x0000000000000019 -> 0x0000000000000099 --> R5Overlap
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-147.147 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70 - Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1069.76 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1066.74 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1052.56 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1067.68 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-147.147.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1064.67 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1033.38 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1062.63 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-147.147+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In Linux kernel md/raid5, expand the protected zone: move sh/head_sh->batch_head = NULL to the end of the protected zone, and use batch_head's device-flag snapshot when head_sh->stripe_lock is not held, so concurrent add_all_stripe_bios() operations cannot race with R5_Overlap handling.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Ubuntu systems using the affected Linux kernel packages are in scope, including linux, linux-aws, linux-azure, linux-gcp, linux-fips, linux-aws-fips, linux-azure-fips, and linux-gcp-fips. The issue is in the kernel's md/raid5 code path.
What access does an attacker need?
The supplied severity vector indicates local access, low privileges, and no user interaction are required. The attack complexity is rated low, with an additional attack requirement present.
What is the operational impact of successful exploitation?
The race can leave a RAID5 request waiting indefinitely for an overlap flag to be cleared and woken. The severity vector rates availability impact as high and integrity impact as low, with no confidentiality impact.
How can I tell whether this is relevant to a workload?
This issue is relevant where the kernel's md/raid5 functionality is used. A symptom described by the report is a request becoming stuck indefinitely while waiting on an R5_Overlap flag.