md/raid1,raid10: fix error-path detection with md_cloned_bio()
CVE-2026-74374 · published 15 Aug 2026
How serious is it
- Severity: high, CVSS score 7.5 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-74374?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 689389a06ce79fdced85b5115717f71c71e623e0 to < 80eaeae0e4b1ed2418fd2b9088238651fb51df69, 689389a06ce79fdced85b5115717f71c71e623e0 to < 8719aa0f57955fd641f952d16e02fc6b4934c6e3, 689389a06ce79fdced85b5115717f71c71e623e0 to < 029b363c9b690613141338436ac91366b1928af2, 689389a06ce79fdced85b5115717f71c71e623e0 to < 20fb582c92fd64e5c8bd83c6176264b2794603b7
- Linux Linux: 4.12
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
md/raid1,raid10: fix error-path detection with md_cloned_bio()
Detect the error path using md_cloned_bio() instead of relying
on r1_bio in raid1 or r10_bio->read_slot in raid10, which may be
NULL or -1 after splitting and resubmitting a failed bio.
As a result, the error path may not be recognized and memory
allocations can incorrectly use GFP_NOIO instead of
(GFP_NOIO | __GFP_HIGH), which can lead to a deadlock under
memory pressure.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/80eaeae0e4b1ed2418fd2b9088238651fb51df69
- git.kernel.org/stable/c/8719aa0f57955fd641f952d16e02fc6b4934c6e3
- git.kernel.org/stable/c/029b363c9b690613141338436ac91366b1928af2
- git.kernel.org/stable/c/20fb582c92fd64e5c8bd83c6176264b2794603b7
- git.kernel.org/stable/c/811545e0926d02a6a0b1a1258bb5544777c164d4
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON