The Linux kernel’s RAID10 subsystem held a reference counting bug that caused writes_pending and barrier references to leak whenever a discard operation failed. Because md_write_end() and allow_barrier() were omitted on certain error paths, the accounting of pending writes and barriers remained unbalanced. Repeated discard failures would accumulate unreleased references, gradually consuming kernel memory and potentially degrading system responsiveness or causing a kernel panic. The leak is a classic resource exhaustion flaw, and while no direct code execution escape is described, the runaway memory usage can lead to denial of service for the affected host.

All Linux kernel builds that lack the commit fixes referenced in the advisory (cited via commit 393d687131d8aa8c7e4de2cb494438e145d20fc2 and d1324b41dabd26787559efaeb430643c627c1eb0) are impacted. The issue is present in raids configured with md/raid10 before the patch and is fixed in kernel releases that incorporate those commits.

The advisory does not specify an exploit payload, and the EPSS score is not available, but the flaw remains in CISA’s KEV catalog as not listed, reflecting a moderate likelihood of exploitation mainly due to the high impact of uncontrolled memory consumption. The vulnerability is exploitable from any context that triggers a discard on a RAID10 device, making it a potential vector for denial of service. The absence of an immediate CISA listing suggests that active exploitation has not been observed, but the deterministic nature of the resource leak warrants proactive mitigation.