CVE-2026-46327 (GCVE-0-2026-46327)

Vulnerability from cvelistv5 – Published: 2026-06-09 12:25 – Updated: 2026-08-05 12:31
VLAI
Title
dm: fix unlocked test for dm_suspended_md
Summary
In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dm_suspended_md The function dm_blk_report_zones tests if the device is suspended with the "dm_suspended_md" call. However, this function is called without holding any locks, so the device may be suspended just after it. Move the call to dm_suspended_md after dm_get_live_table, so that the device can't be suspended after the suspended state was tested.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f9c1bdf24615303d48a2d0fd629c88f3189563aa , < 175ac0a6115400278d3900f5a04a58b17b3f6cd0 (git)
Affected: 37f53a2c60d03743e0eacf7a0c01c279776fef4e , < 7a3385e97af2b6f485fef11e82d8c29adee4be93 (git)
Affected: 37f53a2c60d03743e0eacf7a0c01c279776fef4e , < d809a36692ee1394cac85ce6ba7cf8ea58da5812 (git)
Affected: 37f53a2c60d03743e0eacf7a0c01c279776fef4e , < 24c405fdbe215c45e57bba672cc42859038491ee (git)
Affected: d19bc1b4dd5f322980b1f05f79b2ea4f0db10920 (git)
Affected: 6.12.34 , < 6.12.75 (semver)
Affected: 6.15.3 , < 6.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.14 , ≤ 6.18.* (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-zone.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "175ac0a6115400278d3900f5a04a58b17b3f6cd0",
              "status": "affected",
              "version": "f9c1bdf24615303d48a2d0fd629c88f3189563aa",
              "versionType": "git"
            },
            {
              "lessThan": "7a3385e97af2b6f485fef11e82d8c29adee4be93",
              "status": "affected",
              "version": "37f53a2c60d03743e0eacf7a0c01c279776fef4e",
              "versionType": "git"
            },
            {
              "lessThan": "d809a36692ee1394cac85ce6ba7cf8ea58da5812",
              "status": "affected",
              "version": "37f53a2c60d03743e0eacf7a0c01c279776fef4e",
              "versionType": "git"
            },
            {
              "lessThan": "24c405fdbe215c45e57bba672cc42859038491ee",
              "status": "affected",
              "version": "37f53a2c60d03743e0eacf7a0c01c279776fef4e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d19bc1b4dd5f322980b1f05f79b2ea4f0db10920",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.75",
              "status": "affected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-zone.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.12.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix unlocked test for dm_suspended_md\n\nThe function dm_blk_report_zones tests if the device is suspended with\nthe \"dm_suspended_md\" call. However, this function is called without\nholding any locks, so the device may be suspended just after it.\n\nMove the call to dm_suspended_md after dm_get_live_table, so that the\ndevice can\u0027t be suspended after the suspended state was tested."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local block-layer ioctls (BLKREPORTZONE/BLKREPORTZONEV2 via blkdev_report_zones_ioctl) and device-mapper control ioctls that trigger dm_swap_table/dm_revalidate_zones; there is no network-facing entry point.\nAC:L - Exploitation is a TOCTOU race between concurrent BLKREPORTZONE calls and a zoned dm table activation/revalidation; an attacker can control both sides by running parallel threads and retrying until the window is hit, without depending on uncontrollable timing or memory layout.\nPR:L - Triggering dm table load/swap and zone revalidation requires CAP_SYS_ADMIN, which is obtainable by an unprivileged user inside a user namespace (unshare -Urn); BLKREPORTZONE additionally requires read access to the dm block device, which the same attacker can grant when creating the device.\nUI:N - No victim interaction is required once the attacker has the needed privileges and device access; the race can be driven entirely by attacker-controlled ioctl threads during dm-crypt zoned table setup.\nS:U - The use-after-free corrupts kernel heap metadata and zone-write-plug structures within kernel memory; it does not cross a VM, container, or IOMMU security boundary to affect a separate authority.\nC:H - The bug revives the CVE-2025-38141 class use-after-free where disk_free_zone_resources() can free zone_wplugs_hash/zones_cond while dm_blk_report_zones() still reads them through the live table path, enabling disclosure of freed kernel heap contents.\nI:H - Use-after-free on zone write plug and zone-condition structures provides attacker-influencable heap corruption primitives that can be developed into arbitrary kernel memory writes or control-flow hijack, not merely a bounded modification.\nA:H - Concurrent access to freed zone resources during failed blk_revalidate_disk_zones() can cause kernel oops/panic from dereferencing freed zone_wplugs_hash, zones_cond, or related structures, even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:22.716Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/175ac0a6115400278d3900f5a04a58b17b3f6cd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a3385e97af2b6f485fef11e82d8c29adee4be93"
        },
        {
          "url": "https://git.kernel.org/stable/c/d809a36692ee1394cac85ce6ba7cf8ea58da5812"
        },
        {
          "url": "https://git.kernel.org/stable/c/24c405fdbe215c45e57bba672cc42859038491ee"
        }
      ],
      "title": "dm: fix unlocked test for dm_suspended_md",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46327",
    "datePublished": "2026-06-09T12:25:54.781Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-08-05T12:31:22.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46327",
      "date": "2026-09-23",
      "epss": "0.0012",
      "percentile": "0.02073"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-zone.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "175ac0a6115400278d3900f5a04a58b17b3f6cd0",
                    "status": "affected",
                    "version": "f9c1bdf24615303d48a2d0fd629c88f3189563aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7a3385e97af2b6f485fef11e82d8c29adee4be93",
                    "status": "affected",
                    "version": "37f53a2c60d03743e0eacf7a0c01c279776fef4e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d809a36692ee1394cac85ce6ba7cf8ea58da5812",
                    "status": "affected",
                    "version": "37f53a2c60d03743e0eacf7a0c01c279776fef4e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "24c405fdbe215c45e57bba672cc42859038491ee",
                    "status": "affected",
                    "version": "37f53a2c60d03743e0eacf7a0c01c279776fef4e",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "d19bc1b4dd5f322980b1f05f79b2ea4f0db10920",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.12.75",
                    "status": "affected",
                    "version": "6.12.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "affected",
                    "version": "6.15.3",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-zone.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A8DAA245-0057-42FC-8AC1-567AF3D93866",
                    "versionEndExcluding": "6.12.75",
                    "versionStartIncluding": "6.12.34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BBB52BEE-CB23-4AC5-9EB1-563B3501A7DA",
                    "versionEndExcluding": "6.18.14",
                    "versionStartIncluding": "6.15.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092",
                    "versionEndExcluding": "6.19.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix unlocked test for dm_suspended_md\n\nThe function dm_blk_report_zones tests if the device is suspended with\nthe \"dm_suspended_md\" call. However, this function is called without\nholding any locks, so the device may be suspended just after it.\n\nMove the call to dm_suspended_md after dm_get_live_table, so that the\ndevice can\u0027t be suspended after the suspended state was tested."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndm: correcci\u00f3n de la prueba sin bloqueo para dm_suspended_md\n\nLa funci\u00f3n dm_blk_report_zones comprueba si el dispositivo est\u00e1 suspendido con la llamada a \u0027dm_suspended_md\u0027. Sin embargo, esta funci\u00f3n es llamada sin mantener ning\u00fan bloqueo, por lo que el dispositivo puede ser suspendido justo despu\u00e9s de ella.\n\nMover la llamada a dm_suspended_md despu\u00e9s de dm_get_live_table, para que el dispositivo no pueda ser suspendido despu\u00e9s de que se comprobara el estado de suspensi\u00f3n."
          }
        ],
        "id": "CVE-2026-46327",
        "lastModified": "2026-07-23T08:10:00.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-06-09T14:16:42.400",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/175ac0a6115400278d3900f5a04a58b17b3f6cd0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/24c405fdbe215c45e57bba672cc42859038491ee"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7a3385e97af2b6f485fef11e82d8c29adee4be93"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d809a36692ee1394cac85ce6ba7cf8ea58da5812"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-05T14:41:06+00:00",
      "cve": "CVE-2026-46327",
      "id": "CVE-2026-46327",
      "initial_release_date": "2026-06-09T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm: fix unlocked test for dm_suspended_md",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46327.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.