CVE-2026-43192
Awaiting Analysis Awaiting Analysis - Queue
dm mpath Missing Device Reference in Linux Kernel

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dm mpath: Add missing dm_put_device when failing to get scsi dh name When commit fd81bc5cca8f ("scsi: device_handler: Return error pointer in scsi_dh_attached_handler_name()") added code to fail parsing the path if scsi_dh_attached_handler_name() failed with -ENOMEM, it didn't clean up the reference to the path device that had just been taken. Fix this, and steamline the error paths of parse_path() a little.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-05-07
AI Q&A
2026-05-06
EPSS Evaluated
N/A
NVD
CVE-2026-43192
EUVD
EUVD-2026-27752
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is in the Linux kernel's device mapper multipath (dm mpath) component. It involves a missing cleanup step when an error occurs during the retrieval of the SCSI device handler name. Specifically, when the function scsi_dh_attached_handler_name() fails with an -ENOMEM error, the code did not properly release the reference to the path device that had been acquired. This could lead to resource management issues.


How can this vulnerability impact me? :

The impact of this vulnerability is related to improper resource cleanup in the Linux kernel's multipath device handling. If the reference to the path device is not released properly on error, it could cause resource leaks, potentially leading to increased memory usage or instability in systems using multipath devices.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart