CVE-2026-46107

dm-thin: fix metadata refcount underflow

State: Published
Severity: 7.8 High
Published: May 28, 2026
Updated: Oct 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dm-thin: fix metadata refcount underflow

There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count.

If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors.

Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-667 Improper Locking

Affected Products

Product	Versions
LinuxLinux	3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before b719d12cb94df345e9ad2715fd0abe9afcaeb111Affected 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before f49b41c9eb7c6ff00df27cd49cea210abbadd8adAffected 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before f06f6aededd792a754cd677c02b3d3016d868c2cAffected 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before 12161e03d33afce781f68fa11cc6060538862fadAffected 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before 323d252a4a378834e4fe68298ca61cfc5dd3a460Affected 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before 85311a585a26640760cd0f3349ab9f2905691044Affected 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before 5ec0debbcfd43596e32c1239e993de06a704e04cAffected 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before 09a65adc7d8bbfce06392cb6d375468e2728ead5Affected
LinuxLinux	3.2Affected before 3.2Not affected 5.10.259 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.88 through 6.12.Not affected 6.18.30 through 6.18.Not affected 7.0.7 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before b719d12cb94df345e9ad2715fd0abe9afcaeb111Affected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before f49b41c9eb7c6ff00df27cd49cea210abbadd8adAffected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before f06f6aededd792a754cd677c02b3d3016d868c2cAffected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before 12161e03d33afce781f68fa11cc6060538862fadAffected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before 323d252a4a378834e4fe68298ca61cfc5dd3a460Affected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before 85311a585a26640760cd0f3349ab9f2905691044Affected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before 5ec0debbcfd43596e32c1239e993de06a704e04cAffected
3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 to before 09a65adc7d8bbfce06392cb6d375468e2728ead5Affected

LinuxLinux

3.2Affected
before 3.2Not affected
5.10.259 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.88 through 6.12.*Not affected
6.18.30 through 6.18.*Not affected
7.0.7 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.