High 7.8Published May 28, 2026

CVE-2026-46107dm-thin: fix metadata refcount underflow

Updated under an hour ago (Oct 27, 2026, 12:40 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-667
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 before b719d12cb94df345e9ad2715fd0abe9afcaeb111; from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 before f49b41c9eb7c6ff00df27cd49cea210abbadd8ad; from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 before f06f6aededd792a754cd677c02b3d3016d868c2c; from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 before 12161e03d33afce781f68fa11cc6060538862fad; 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 builds before 323d252a4a378834e4fe68298ca61cfc5dd3a460; from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 before 85311a585a26640760cd0f3349ab9f2905691044; 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 builds before 5ec0debbcfd43596e32c1239e993de06a704e04c; 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 builds before 09a65adc7d8bbfce06392cb6d375468e2728ead5	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.2 before 5.10.259; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.7; 7.1	NVD

References

References

https://git.kernel.org/stable/c/b719d12cb94df345e9ad2715fd0abe9afcaeb111	patch
https://git.kernel.org/stable/c/f49b41c9eb7c6ff00df27cd49cea210abbadd8ad	patch
https://git.kernel.org/stable/c/f06f6aededd792a754cd677c02b3d3016d868c2c	patch
https://git.kernel.org/stable/c/12161e03d33afce781f68fa11cc6060538862fad	patch
https://git.kernel.org/stable/c/323d252a4a378834e4fe68298ca61cfc5dd3a460	patch
https://git.kernel.org/stable/c/85311a585a26640760cd0f3349ab9f2905691044	patch
https://git.kernel.org/stable/c/5ec0debbcfd43596e32c1239e993de06a704e04c	patch
https://git.kernel.org/stable/c/09a65adc7d8bbfce06392cb6d375468e2728ead5	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.