CVE-2026-72420

This race condition in md/raid5 stripe batching isn't simply a missed memory barrier — it's a compound-state tear. The code treats `batch_head` pointer navigation and `R5_Overlap` flag management as independent concerns when they're actually tightly coupled in a concurrent state machine. The race triggers because `break_stripe_batch_list()` clears `batch_head` before clearing `R5_Overlap`, allowing `raid5_make_request()` to observe `batch_head == NULL`, conclude no batch conflict exists, set `R5_Overlap`, and then wait — without ever being woken. The fix expands the protected zone to cover both operations, which is correct, but it restructures an atomicity boundary rather than redesigning the underlying pattern. The deeper concern: this exact topology (plain-word writes interleaved with bitops on the same logical state, accessed from both interrupt and process context) likely exists elsewhere in md/raid5. The subsystem's stripe state machine evolved by accretion — batch_head, per-device R5_* flags, and bio lists were layered over years as separate concerns. KCSAN is now exposing races that were always latent but never fatal under older tooling. The pattern will recur elsewhere in the subsystem. What makes this high-severity in practice isn't crash behavior — it's silent data inconsistency. The orphaned bio scenario leaves I/O permanently pending while parity state becomes incoherent across the stripe. In dedup or hybrid cache workloads with overlapping I/O patterns, this condition is realistically triggerable. The EPSS score of 0.00445 reflects low active exploitation, but the failure mode is subtle and hard to debug. Check your kernel version for the fix (commit-specific). Monitor for I/O wait timeouts in high-throughput raid5 deployments. The real question isn't whether this race is fixed — it's whether your storage stack has other compound-state transitions with the same topology that KCSAN hasn't yet surfaced. The subsystem's approach to stripe state transitions needs scrutiny, not just this instance.

Reviewed through automated stages and approved by a human before publication.