dm mpath Missing Device Reference in Linux Kernel

Publication date: 2026-05-06

Last updated on: 2026-05-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dm mpath: Add missing dm_put_device when failing to get scsi dh name When commit fd81bc5cca8f ("scsi: device_handler: Return error pointer in scsi_dh_attached_handler_name()") added code to fail parsing the path if scsi_dh_attached_handler_name() failed with -ENOMEM, it didn't clean up the reference to the path device that had just been taken. Fix this, and steamline the error paths of parse_path() a little.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-06

Last Modified

2026-05-11

Generated

2026-07-06

AI Q&A

2026-05-06

EPSS Evaluated

2026-07-05

NVD

CVE-2026-43192

EUVD

EUVD-2026-27752

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 6.19.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's device mapper multipath (dm mpath) component. It involves a missing cleanup step when an error occurs during the retrieval of the SCSI device handler name. Specifically, when the function scsi_dh_attached_handler_name() fails with an -ENOMEM error, the code did not properly release the reference to the path device that had been acquired. This could lead to resource management issues.

Impact Analysis

The impact of this vulnerability is related to improper resource cleanup in the Linux kernel's multipath device handling. If the reference to the path device is not released properly on error, it could cause resource leaks, potentially leading to increased memory usage or instability in systems using multipath devices.

Hi! I’m here to help you understand CVE-2026-43192. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70