CVE-2026-72420

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md/raid5: avoid R5_Overlap races while breaking stripe batches

KCSAN report a race in break_stripe_batch_list() vs. raid5_make_request()

on sh->dev[i].flags (plain word write vs. atomic bit op)..

and .. one possible scenario is:

CPU1 CPU2

break_stripe_batch_list(sh1)

-> handle sh2

-> lock(sh2)

-> sh2->batch_head = NULL

-> unlock(sh2)

-> test_and_clear_bit(R5_Overlap, sh2->dev[i].flags)

-> wake_up_bit(sh2->dev[i].flags)

raid5_make_request()

-> add_all_stripe_bios(sh2)

-> lock(sh2)

-> stripe_bio_overlaps(sh2) returns true

batch_head is NULL, so new bio overlap

exist bio on sh2 -> true

-> set_bit(R5_Overlap, sh2->dev[i].flags)

-> unlock(sh2)

-> wait_on_bit(s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References