A flaw in the Linux kernel’s RAID10 implementation causes the system to skip releasing a replacement bio during discard operations when the read_slot value is non‑negative. This results in a leak of kernel resources, which can accumulate over time and potentially exhaust system memory or disk buffers, leading to instability or denial of service. The core weakness is improper cleanup of resources, classified as a missing release of resource before reuse (CWE‑772).

The vulnerability affects the Linux kernel, specifically the md/raid10 module. The affected releases are all kernel versions compiled before the patch that resets read_slot during discard preparation; explicit version ranges are not listed in the advisory.

The CVSS score of 9.8 indicates critical severity. The EPSS score of <1% suggests a very low probability of exploitation. Based on the description, it is inferred that the vulnerability is local and would require privileged or kernel‑mode access to trigger repeated discard operations on a RAID10 array. Although exploitation evidence is currently absent and the vulnerability is not listed in CISA’s KEV catalog, the potential for resource exhaustion could lead to denial of service if an attacker can repeatedly invoke the bug.