Executive brief
A vulnerability was identified in the Linux kernel's device mapper (dm-thin) component, which manages thin-provisioned storage volumes. A bug in how the system tracks data references can lead to internal metadata errors and potential storage instability. This could result in system errors or data management failures on affected storage devices.
Technical details
A vulnerability exists in the dm-thin component of the Linux kernel within the rebalance_children function in drivers/md/persistent-data/dm-btree-remove.c. When an internal btree node has a single entry, the code attempts to copy entries from a child node to the parent and decrement the child's reference count. If the child node is shared (refcount > 1), the grandchildren's reference counts are not appropriately incremented to reflect the new pointers, leading to a reference count underflow. This manifests as 'unable to decrement block' errors in the space map. The fix involves explicitly incrementing the reference counts of grandchildren nodes when the btree node is shared.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-20: patched: Initial patch authored by Mikulas Patocka
- 2026-05-28: disclosed: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/09a65adc7d8bbfce06392cb6d375468e2728ead5
- https://git.kernel.org/stable/c/12161e03d33afce781f68fa11cc6060538862fad
- https://git.kernel.org/stable/c/323d252a4a378834e4fe68298ca61cfc5dd3a460
- https://git.kernel.org/stable/c/5ec0debbcfd43596e32c1239e993de06a704e04c
- https://git.kernel.org/stable/c/85311a585a26640760cd0f3349ab9f2905691044