CVE-2026-46107

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46107", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.098Z", "datePublished": "2026-05-28T09:35:13.051Z", "dateUpdated": "2026-10-19T19:26:43.751Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:29:40.825Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-thin: fix metadata refcount underflow\n\nThere's a bug in dm-thin in the function rebalance_children. If the\ninternal btree node has one entry, the code tries to copy all btree\nentries from the node's child to the node itself and then decrement the\nchild's reference count.\n\nIf the child node is shared (it has reference count > 1), we won't free\nit, so there would be two pointers to each of the grandchildren nodes.\nBut the reference counts of the grandchildren is not increased, thus the\nreference count doesn't match the number of pointers that point to the\ngrandchildren. This results in \"device mapper: space map common: unable\nto decrement block\" errors.\n\nFix this bug by incrementing reference counts on the grandchildren if the\nbtree node is shared."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is in the device-mapper thin-provisioning metadata layer, reached only via local block I/O (discard/TRIM) to a thin volume or local device-mapper ioctls \u2014 there is no network-facing path.\nAC:L - The bug arises during ordinary snapshot+removal workflows; an attacker controlling the operations (snapshots plus repeated removals/discards) reliably produces a single-entry internal node over a shared child, with no condition beyond their control.\nPR:L - Although pool/snapshot setup needs CAP_SYS_ADMIN, the triggering removal is reachable through discard/TRIM I/O on a snapshotted thin volume \u2014 e.g. an unprivileged user deleting files on a discard-mounted fs or a delegated volume in a multi-tenant/container deployment.\nUI:N - The attacker triggers the corruption directly through their own discard/removal operations; no action by a separate victim is required.\nS:U - The corruption stays within the kernel's storage subsystem and the affected thin pool; it does not cross into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - The refcount underflow prematurely frees still-referenced blocks that get reallocated, so reads through the surviving snapshot reference can disclose whole reallocated blocks of unrelated (potentially other tenants') data.\nI:H - Double-allocated blocks and corrupted btree/space-map metadata allow modification of data belonging to other thin volumes/snapshots and corruption of pool metadata structures.\nA:H - The underflow produces \"unable to decrement block\" errors that abort the metadata transaction and force the pool read-only/fail, and corrupted metadata can crash the kernel on subsequent validation."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/persistent-data/dm-btree-remove.c"], "versions": [{"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "b719d12cb94df345e9ad2715fd0abe9afcaeb111", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "f49b41c9eb7c6ff00df27cd49cea210abbadd8ad", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "f06f6aededd792a754cd677c02b3d3016d868c2c", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "12161e03d33afce781f68fa11cc6060538862fad", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "323d252a4a378834e4fe68298ca61cfc5dd3a460", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "85311a585a26640760cd0f3349ab9f2905691044", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "5ec0debbcfd43596e32c1239e993de06a704e04c", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "09a65adc7d8bbfce06392cb6d375468e2728ead5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/persistent-data/dm-btree-remove.c"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b719d12cb94df345e9ad2715fd0abe9afcaeb111"}, {"url": "https://git.kernel.org/stable/c/f49b41c9eb7c6ff00df27cd49cea210abbadd8ad"}, {"url": "https://git.kernel.org/stable/c/f06f6aededd792a754cd677c02b3d3016d868c2c"}, {"url": "https://git.kernel.org/stable/c/12161e03d33afce781f68fa11cc6060538862fad"}, {"url": "https://git.kernel.org/stable/c/323d252a4a378834e4fe68298ca61cfc5dd3a460"}, {"url": "https://git.kernel.org/stable/c/85311a585a26640760cd0f3349ab9f2905691044"}, {"url": "https://git.kernel.org/stable/c/5ec0debbcfd43596e32c1239e993de06a704e04c"}, {"url": "https://git.kernel.org/stable/c/09a65adc7d8bbfce06392cb6d375468e2728ead5"}], "title": "dm-thin: fix metadata refcount underflow", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:20:32.520Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46107", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:19:39.761599Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-667", "description": "CWE-667 Improper Locking"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:26:43.751Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46107", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.098Z", "datePublished": "2026-05-28T09:35:13.051Z", "dateUpdated": "2026-10-16T15:20:50.990Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:29:40.825Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-thin: fix metadata refcount underflow\n\nThere's a bug in dm-thin in the function rebalance_children. If the\ninternal btree node has one entry, the code tries to copy all btree\nentries from the node's child to the node itself and then decrement the\nchild's reference count.\n\nIf the child node is shared (it has reference count > 1), we won't free\nit, so there would be two pointers to each of the grandchildren nodes.\nBut the reference counts of the grandchildren is not increased, thus the\nreference count doesn't match the number of pointers that point to the\ngrandchildren. This results in \"device mapper: space map common: unable\nto decrement block\" errors.\n\nFix this bug by incrementing reference counts on the grandchildren if the\nbtree node is shared."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is in the device-mapper thin-provisioning metadata layer, reached only via local block I/O (discard/TRIM) to a thin volume or local device-mapper ioctls \u2014 there is no network-facing path.\nAC:L - The bug arises during ordinary snapshot+removal workflows; an attacker controlling the operations (snapshots plus repeated removals/discards) reliably produces a single-entry internal node over a shared child, with no condition beyond their control.\nPR:L - Although pool/snapshot setup needs CAP_SYS_ADMIN, the triggering removal is reachable through discard/TRIM I/O on a snapshotted thin volume \u2014 e.g. an unprivileged user deleting files on a discard-mounted fs or a delegated volume in a multi-tenant/container deployment.\nUI:N - The attacker triggers the corruption directly through their own discard/removal operations; no action by a separate victim is required.\nS:U - The corruption stays within the kernel's storage subsystem and the affected thin pool; it does not cross into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - The refcount underflow prematurely frees still-referenced blocks that get reallocated, so reads through the surviving snapshot reference can disclose whole reallocated blocks of unrelated (potentially other tenants') data.\nI:H - Double-allocated blocks and corrupted btree/space-map metadata allow modification of data belonging to other thin volumes/snapshots and corruption of pool metadata structures.\nA:H - The underflow produces \"unable to decrement block\" errors that abort the metadata transaction and force the pool read-only/fail, and corrupted metadata can crash the kernel on subsequent validation."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/persistent-data/dm-btree-remove.c"], "versions": [{"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "b719d12cb94df345e9ad2715fd0abe9afcaeb111", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "f49b41c9eb7c6ff00df27cd49cea210abbadd8ad", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "f06f6aededd792a754cd677c02b3d3016d868c2c", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "12161e03d33afce781f68fa11cc6060538862fad", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "323d252a4a378834e4fe68298ca61cfc5dd3a460", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "85311a585a26640760cd0f3349ab9f2905691044", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "5ec0debbcfd43596e32c1239e993de06a704e04c", "status": "affected", "versionType": "git"}, {"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "lessThan": "09a65adc7d8bbfce06392cb6d375468e2728ead5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/persistent-data/dm-btree-remove.c"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b719d12cb94df345e9ad2715fd0abe9afcaeb111"}, {"url": "https://git.kernel.org/stable/c/f49b41c9eb7c6ff00df27cd49cea210abbadd8ad"}, {"url": "https://git.kernel.org/stable/c/f06f6aededd792a754cd677c02b3d3016d868c2c"}, {"url": "https://git.kernel.org/stable/c/12161e03d33afce781f68fa11cc6060538862fad"}, {"url": "https://git.kernel.org/stable/c/323d252a4a378834e4fe68298ca61cfc5dd3a460"}, {"url": "https://git.kernel.org/stable/c/85311a585a26640760cd0f3349ab9f2905691044"}, {"url": "https://git.kernel.org/stable/c/5ec0debbcfd43596e32c1239e993de06a704e04c"}, {"url": "https://git.kernel.org/stable/c/09a65adc7d8bbfce06392cb6d375468e2728ead5"}], "title": "dm-thin: fix metadata refcount underflow", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:20:32.520Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46107", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:19:39.761599Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:19:40.382Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/md/persistent-data/dm-btree-remove.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b719d12cb94df345e9ad2715fd0abe9afcaeb111", "status": "affected", "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "versionType": "git"}, {"lessThan": "f49b41c9eb7c6ff00df27cd49cea210abbadd8ad", "status": "affected", "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "versionType": "git"}, {"lessThan": "f06f6aededd792a754cd677c02b3d3016d868c2c", "status": "affected", "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "versionType": "git"}, {"lessThan": "12161e03d33afce781f68fa11cc6060538862fad", "status": "affected", "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "versionType": "git"}, {"lessThan": "323d252a4a378834e4fe68298ca61cfc5dd3a460", "status": "affected", "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "versionType": "git"}, {"lessThan": "85311a585a26640760cd0f3349ab9f2905691044", "status": "affected", "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "versionType": "git"}, {"lessThan": "5ec0debbcfd43596e32c1239e993de06a704e04c", "status": "affected", "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "versionType": "git"}, {"lessThan": "09a65adc7d8bbfce06392cb6d375468e2728ead5", "status": "affected", "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/md/persistent-data/dm-btree-remove.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"lessThan": "3.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.88", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.30", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC53F596-A57D-4444-90F4-98E548AF23A0", "versionEndExcluding": "5.10.259", "versionStartIncluding": "3.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D", "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4", "versionEndExcluding": "6.12.88", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B", "versionEndExcluding": "6.18.30", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-thin: fix metadata refcount underflow\n\nThere's a bug in dm-thin in the function rebalance_children. If the\ninternal btree node has one entry, the code tries to copy all btree\nentries from the node's child to the node itself and then decrement the\nchild's reference count.\n\nIf the child node is shared (it has reference count > 1), we won't free\nit, so there would be two pointers to each of the grandchildren nodes.\nBut the reference counts of the grandchildren is not increased, thus the\nreference count doesn't match the number of pointers that point to the\ngrandchildren. This results in \"device mapper: space map common: unable\nto decrement block\" errors.\n\nFix this bug by incrementing reference counts on the grandchildren if the\nbtree node is shared."}], "id": "CVE-2026-46107", "lastModified": "2026-10-19T20:18:30.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46107", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:19:39.761599Z", "version": "2.0.3"}}]}, "published": "2026-05-28T10:16:26.063", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/09a65adc7d8bbfce06392cb6d375468e2728ead5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/12161e03d33afce781f68fa11cc6060538862fad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/323d252a4a378834e4fe68298ca61cfc5dd3a460"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5ec0debbcfd43596e32c1239e993de06a704e04c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/85311a585a26640760cd0f3349ab9f2905691044"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b719d12cb94df345e9ad2715fd0abe9afcaeb111"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f06f6aededd792a754cd677c02b3d3016d868c2c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f49b41c9eb7c6ff00df27cd49cea210abbadd8ad"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-667"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: dm-thin: fix metadata refcount underflow", "id": "2482637", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482637"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's Device Mapper (dm-thin) component. This vulnerability, a metadata reference count underflow, occurs in the `rebalance_children` function. When an internal btree node with a single entry is shared, the system incorrectly tracks the usage of child nodes. This can lead to 'device mapper: space map common: unable to decrement block' errors, potentially causing a denial of service or data integrity issues."], "name": "CVE-2026-46107", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46107\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46107\nhttps://lore.kernel.org/linux-cve-announce/2026052812-CVE-2026-46107-709a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3241b1d3e0aaafbfcd320f4d71ade629728cc4f4,12161e03d33afce781f68fa11cc6060538862fad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3241b1d3e0aaafbfcd320f4d71ade629728cc4f4,323d252a4a378834e4fe68298ca61cfc5dd3a460)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3241b1d3e0aaafbfcd320f4d71ade629728cc4f4,85311a585a26640760cd0f3349ab9f2905691044)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3241b1d3e0aaafbfcd320f4d71ade629728cc4f4,5ec0debbcfd43596e32c1239e993de06a704e04c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3241b1d3e0aaafbfcd320f4d71ade629728cc4f4,09a65adc7d8bbfce06392cb6d375468e2728ead5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.88,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.30,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-28T11:30:15.487273+00:00", "updated": "2026-10-23T01:15:14.055718+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}