The kernel’s RAID‑10 subsystem can acquire a writes_pending reference before scheduling a write, but failure paths in the request handler sometimes return without calling the matching release function. The result is an unreleased reference that grows each time a write fails. The leak is an uncontrolled resource consumption flaw. The impact is a gradual increase in kernel resource usage, which can degrade performance or trigger a crash over time. This conclusion is inferred from the description of a missing release on failure paths, as the effect of a growing counter is not explicitly stated in the CVE record.

All Linux kernel builds that lack the upstream commit correcting the writes_pending leak in md/raid10. No specific version range is supplied, so any kernel older than the patch may be vulnerable. The affected products are Linux kernels on systems using the md RAID‑10 driver (e.g., standard distribution kernels that do not include the fix).

The CVSS score of 5.5 indicates moderate severity. The EPSS score is listed as "< 1%", implying exploit probability is very low. The vulnerability is not in the CISA KEV catalog. Exploitation would likely need local or privileged access to trigger write failures in a RAID‑10 array. Because the flaw does not directly grant code execution, the primary threat is a denial‑of‑service scenario manifested as resource exhaustion.