CVE-2026-23356
Logic Bug in Linux DRBD Activity Log Causes Potential Crash
Publication date: 2026-03-25
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 3.10 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.7 (exc) |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.17 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.77 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.167 (exc) |
| linux | linux_kernel | From 3.10.1 (inc) to 5.10.253 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-617 | The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a logic bug in the Linux kernel's drbd component, specifically in the function drbd_al_begin_io_nonblock(). The issue arises because even though the code checks if it should be able to perform lc_get_cumulative() while holding a spinlock, it can still fail due to timing conflicts with another code path using lc_try_lock().
When this failure occurs, the system logs a "LOGIC BUG" message but does not return an error, leading the rest of the code to incorrectly assume that the request has valid references for the relevant activity log extents. This can cause problems during an active resync, where mutual exclusivity between resync and application IO is not guaranteed, potentially leading to crashes or inconsistent states.
Additionally, after the request completes, it may release activity log references it does not hold, triggering a kernel bug (BUG_ON) due to a zero reference count.
The fix involves handling the condition more gracefully by catching cases where the reference count is zero and returning an error code instead of assuming success. This allows the system to properly handle partial states and resume operations correctly.
How can this vulnerability impact me? :
This vulnerability can impact system stability and data integrity during active resync operations in the drbd component of the Linux kernel.
Because mutual exclusivity between resync and application IO is not guaranteed, there is a risk of kernel crashes or inconsistent data states if in-flight IO targets extents that are being resynced.
Furthermore, the bug can cause the kernel to crash due to improper handling of activity log references, which may lead to system downtime or data loss.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by fixing the logic bug in the drbd_al_begin_io_nonblock() function in the Linux kernel. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.
The fix ensures that the kernel does not crash due to harmless conditions during normal operation and properly handles error codes when activity log references are partially held. Applying the updated kernel will prevent potential crashes and data inconsistencies during active resync operations.