{"cve":"CVE-2026-74373","nvd":{"published":"2026-08-15T06:22:39.070","modified":"2026-10-21T13:19:43.147","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1,raid10: fix bio accounting for split md cloned bios\n\nUse md_cloned_bio() to control bio accounting instead of relying\non r1bio_existed in raid1 or the io_accounting flag in raid10.\n\nThe previous logic does not reliably reflect whether a bio is an\nmd cloned bio. When a failed bio is split and resubmitted via\nbio_submit_split_bioset() on the error path, this can lead to either\ndouble accounting for md cloned bios, or missing accounting for bios\nreturned from bio_submit_split_bioset()\n\nFix this by using md_cloned_bio() to detect md cloned bios and\nskip accounting accordingly.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/235d16ae715104b981a4fbc9434398e3816773b1","https://git.kernel.org/stable/c/91d0fc000d8cc40fcb4285e6160dd1ce98c56201","https://git.kernel.org/stable/c/ba976e3501111d11c550848b3b7341a73035f582","https://git.kernel.org/stable/c/bb8d7ea74206b419aa05d7773a15a923b668c9f0","https://git.kernel.org/stable/c/bcf30e14d2bd509c57e93021b46aedc878896e7b"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-74373","score":0.00209,"percentile":0.10907,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}