In the Linux kernel, the following vulnerability has been resolved:
md/raid10: reset read_slot when reusing r10bio for discard
put_all_bios() always drops devs[i].bio, but it only drops
devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an
r10bio that was previously used for a read, read_slot can still be
non-negative, and discard cleanup can skip bio_put() on repl_bio.
Reset read_slot to -1 when preparing an r10bio for discard so the
replacement bio is always released correctly.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - iSCSI/NVMe-oF targets and appliances commonly expose RAID10-backed LUNs; remote SCSI UNMAP maps through target_core iblock_execute_unmap()/blkdev_issue_discard() to md_handle_request() and raid10_handle_discard without local access.
AC:L - The attacker controls both pool poisoning reads and triggering discards; mempool-reused r10bios retain a non-negative read_slot from prior reads, so each qualifying discard reliably skips repl_bio bio_put() when replacement mirrors exist.
PR:N - Network UNMAP from an iSCSI/NVMe-oF client needs no Linux UID or capabilities on the target; local exploitation only needs O_RDWR on the md device or FITRIM (CAP_SYS_ADMIN, obtainable in user namespaces), both below High.
UI:N - No interactive victim action—exploitation uses normal block-layer discard requests (fstrim cron, UNMAP, BLKDISCARD) issued or scripted by the attacker without cooperation.
S:U - The bug corrupts/leaks kernel bio objects within the same host kernel security domain; it does not cross VM, container, or IOMMU boundaries.
C:H - Stale read_slot misclassifies repl_bio as rdev in the r10dev union during put_all_bios(), leaking live bios holding kernel pointers and enabling heap-grooming read primitives; scored High when uncertain per memory-corruption guidance.
I:H - The read_slot/repl_bio union type confusion skips bio_put() on attacker-submitted replacement discard clones, enabling slab manipulation for arbitrary kernel writes; type confusion maps to High integrity impact per kernel CVSS guidance.
A:H - Repeated read-then-discard cycles leak bios on every hit; on busy RAID10 storage servers this exhausts kmem and can trigger OOM killer or panic, so Availability is High rather than Low per the conservative rule.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - iSCSI/NVMe-oF targets and appliances commonly expose RAID10-backed LUNs; remote SCSI UNMAP maps through target_core iblock_execute_unmap()/blkdev_issue_discard() to md_handle_request() and raid10_handle_discard without local access.
AC:L - The attacker controls both pool poisoning reads and triggering discards; mempool-reused r10bios retain a non-negative read_slot from prior reads, so each qualifying discard reliably skips repl_bio bio_put() when replacement mirrors exist.
PR:N - Network UNMAP from an iSCSI/NVMe-oF client needs no Linux UID or capabilities on the target; local exploitation only needs O_RDWR on the md device or FITRIM (CAP_SYS_ADMIN, obtainable in user namespaces), both below High.
UI:N - No interactive victim action—exploitation uses normal block-layer discard requests (fstrim cron, UNMAP, BLKDISCARD) issued or scripted by the attacker without cooperation.
S:U - The bug corrupts/leaks kernel bio objects within the same host kernel security domain; it does not cross VM, container, or IOMMU boundaries.
C:H - Stale read_slot misclassifies repl_bio as rdev in the r10dev union during put_all_bios(), leaking live bios holding kernel pointers and enabling heap-grooming read primitives; scored High when uncertain per memory-corruption guidance.
I:H - The read_slot/repl_bio union type confusion skips bio_put() on attacker-submitted replacement discard clones, enabling slab manipulation for arbitrary kernel writes; type confusion maps to High integrity impact per kernel CVSS guidance.
A:H - Repeated read-then-discard cycles leak bios on every hit; on busy RAID10 storage servers this exhausts kmem and can trigger OOM killer or panic, so Availability is High rather than Low per the conservative rule.
CVSS 3.1