CVE-2026-46107

Description

In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0013

Probability of exploitation

0.03%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/09a65adc7d8bbfce06392cb6d375468e2728ead5 https://git.kernel.org/stable/c/12161e03d33afce781f68fa11cc6060538862fad https://git.kernel.org/stable/c/323d252a4a378834e4fe68298ca61cfc5dd3a460 https://git.kernel.org/stable/c/5ec0debbcfd43596e32c1239e993de06a704e04c https://git.kernel.org/stable/c/85311a585a26640760cd0f3349ab9f2905691044 https://git.kernel.org/stable/c/f06f6aededd792a754cd677c02b3d3016d868c2c https://git.kernel.org/stable/c/f49b41c9eb7c6ff00df27cd49cea210abbadd8ad

Frequently Asked Questions

What is CVE-2026-46107? +

In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-46107? +

CVE-2026-46107 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0013, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-46107? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.