CVE-2026-46107 Details
Description
In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared.
A vulnerability exists in the Linux kernel's device mapper thin provisioning module (dm-thin), specifically in the 'rebalance_children' function. The issue arises when an internal B-tree node contains a single entry. The code attempts to transfer all B-tree entries from the child node to the current node and subsequently reduce the child's reference count. However, if the child node is shared (reference count greater than one), it is not freed, leading to two pointers for each grandchild node without an appropriate increase in the grandchildren's reference counts. This mismatch causes 'device mapper: space map common: unable to decrement block' errors. The vulnerability has been addressed by ensuring that reference counts for the grandchildren are incremented when the B-tree node is shared.
Users can upgrade to the patched version of the Linux kernel available in the official Linux kernel repositories.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/09a65adc7d8bbfce06392cb6d375468e2728ead5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/12161e03d33afce781f68fa11cc6060538862fad | kernel.org | Patch |
| https://git.kernel.org/stable/c/323d252a4a378834e4fe68298ca61cfc5dd3a460 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5ec0debbcfd43596e32c1239e993de06a704e04c | kernel.org | Patch |
| https://git.kernel.org/stable/c/85311a585a26640760cd0f3349ab9f2905691044 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b719d12cb94df345e9ad2715fd0abe9afcaeb111 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f06f6aededd792a754cd677c02b3d3016d868c2c | kernel.org | Patch |
| https://git.kernel.org/stable/c/f49b41c9eb7c6ff00df27cd49cea210abbadd8ad | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 3.2, < 5.10.259 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.140 >= 6.7, < 6.12.88 >= 6.13, < 6.18.30 >= 6.19, < 7.0.7 7.1 rc1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 19, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 30, 2026 | CVE Modified | kernel.org |
| May 28, 2026 | New CVE Received | kernel.org |