In the Linux kernel, the raid1 write routine fails to decrement a pending reference count when an atomic write encounters a bad block. The leaked reference remains in the device structure, blocking removal of the RAID1 member and eventually exhausting the pending counter. This resource leak can lead to the inability to cleanly remove or replace a RAID1 device, potentially rendering the array unusable.

All Linux kernel builds that precede the inclusion of commit 5ac9e793ba2583d72740d929e7858a6c82e22ed5 are affected. The issue exists in the raid1 module of the generic kernel for all supported distributions that have not yet applied the fix.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require a local or privileged write to a RAID1 volume that triggers a bad‑block error; repeated failures could accumulate leaked references and lead to a denial of service. The overall risk is moderate, driven mainly by the potential for resource exhaustion on systems that frequently write through RAID1 devices.