CVE-2026-46107

Analyzed Analyzed - Analysis Complete

dm-thin Metadata Refcount Underflow in Linux Kernel

Publication date: 2026-05-28

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-28

Last Modified

2026-06-25

Generated

2026-07-08

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-06

NVD

CVE-2026-46107

EUVD

EUVD-2026-32866

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.30 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.7 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.88 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 3.2 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's dm-thin module, specifically in the function rebalance_children. The bug occurs when an internal btree node with one entry tries to copy all btree entries from its child node to itself and then decrements the child's reference count.

If the child node is shared (meaning it has a reference count greater than 1), the code does not free it, resulting in two pointers to each of the grandchildren nodes. However, the reference counts of the grandchildren are not incremented accordingly, causing a mismatch between the number of pointers and the reference counts.

This mismatch leads to errors such as "device mapper: space map common: unable to decrement block." The fix involves incrementing the reference counts on the grandchildren nodes if the btree node is shared.

Impact Analysis

This vulnerability can cause errors in the device mapper's space map, specifically "unable to decrement block" errors, which may lead to incorrect reference counting in the dm-thin module.

Such errors could potentially result in data integrity issues or unexpected behavior in storage management, as the reference counts do not accurately reflect the actual usage of the underlying data structures.

Detection Guidance

This vulnerability manifests as errors related to device mapper metadata reference counts, specifically "device mapper: space map common: unable to decrement block" errors.

To detect this issue on your system, you can monitor system logs for these specific error messages.

Use the command: sudo dmesg | grep 'device mapper: space map common: unable to decrement block'
Check system logs with: sudo journalctl -k | grep 'device mapper: space map common: unable to decrement block'

These commands help identify if the dm-thin metadata refcount underflow bug is occurring by detecting the related error messages.

Mitigation Strategies

The vulnerability is fixed by updating the Linux kernel to a version where the dm-thin metadata refcount underflow bug is resolved.

Immediate mitigation steps include:

Update your Linux kernel to the latest patched version that includes the fix for dm-thin.
Monitor system logs for the related error messages to detect if the issue persists.
Avoid using affected dm-thin features or configurations until the patch is applied.

Hi! I’m here to help you understand CVE-2026-46107. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70