CVE-2026-43314
Request Leak in Linux Kernel Device Mapper
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | 6.19.0-rc1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's device mapper (dm) driver. The dm driver does not implement its own timeout handler and relies on its slave devices for timeout handling. Since a certain commit, drivers are expected to call blk_should_fake_timeout() to handle timeouts properly. However, the dm driver incorrectly uses this fake timeout mechanism without having native timeout handling.
When an io-timeout-fail error is injected into a dm device, the request is leaked and never completed. This causes tasks to hang indefinitely, leading to system instability or unresponsive behavior.
How can this vulnerability impact me? :
The impact of this vulnerability is that tasks interacting with the dm device can hang indefinitely due to leaked requests that are never completed. This can cause system processes to become unresponsive, potentially leading to degraded system performance or denial of service conditions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing if tasks hang indefinitely when an io-timeout-fail error is injected to a device mapper (dm) device that has an iSCSI slave device.
To reproduce and detect the issue, you can use the following commands:
- echo 1 > /sys/class/block/dm-0/io-timeout-fail
- echo 100 > /sys/kernel/debug/fail_io_timeout/probability
- echo 10 > /sys/kernel/debug/fail_io_timeout/times
Then perform read/write operations on the dm device and run:
- iscsiadm -m node -u
If the vulnerability is present, you will see tasks hanging with messages similar to kernel logs indicating blocked tasks, such as:
- INFO: task kworker/u514:2:151 blocked for more than 122 seconds.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by removing the fake timeout check (blk_should_fake_timeout()) from the dm driver, as dm does not have native timeout handling and should not attempt to fake timeouts.
Immediate mitigation steps include:
- Update your Linux kernel to a version that includes the fix (commit 15f73f5b3e59 or later).
- Avoid injecting io-timeout-fail errors into dm devices, especially those with iSCSI slave devices.
- Monitor for hung tasks related to dm devices and iSCSI sessions and consider restarting affected services or systems if hangs occur.