Executive brief
A vulnerability in the Linux kernel's Device Mapper (DM) component can cause system tasks to hang indefinitely. This occurs when specific I/O error injection tests are performed, leading to leaked requests that never complete. While primarily affecting system stability during testing or specific failure scenarios, it can result in a denial-of-service state for affected storage operations.
Technical details
The vulnerability exists in the Device Mapper (DM) driver due to an improper implementation of timeout handling following changes in the blk-mq subsystem. Specifically, the DM driver was calling 'blk_should_fake_timeout()' without implementing its own timeout handler, relying instead on slave devices. When an 'io-timeout-fail' error is injected into a DM device, the request is leaked and never marked as completed. This results in kernel tasks (such as kworkers) blocking indefinitely during I/O operations or session unbinding. The fix involves removing the 'blk_should_fake_timeout()' check in 'drivers/md/dm-rq.c' to ensure requests are always completed via 'blk_mq_complete_request()'.
Affected products
- Linux Linux Kernel 6.19.0-rc1+
Timeline
- 2025-12-20: other: Patch authored by Ding Hui
- 2026-03-04: patched: Patch committed to stable tree by Sasha Levin
- 2026-05-08: advisory: CVE-2026-43314 published
References
- https://git.kernel.org/stable/c/4f9e7ca933a9fbf9912a384b061a00c77332cbf0
- https://git.kernel.org/stable/c/6cdb21e0c9fdee484feba14fc9e72e9d07daf9f3
- https://git.kernel.org/stable/c/8200fca818c1e2f65bc6cb16d934ff6049302197
- https://git.kernel.org/stable/c/b307b6307f6459841312432bd4bc9519cbac97f5
- https://git.kernel.org/stable/c/c8a23d4c995ef4227bd4de64cd3910637ee6162e
- https://git.kernel.org/stable/c/cf2d06c9fd4b6521ea5b7f73c99c64c2c6f5e224
- https://git.kernel.org/stable/c/ece6720de9403260088209b0b92d45e0b49ff856