CVE-2026-46327dm: fix unlocked test for dm_suspended_md
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dm_suspended_md The function dm_blk_report_zones tests if the device is suspended with the "dm_suspended_md" call. However, this function is called without holding any locks, so the device may be suspended just after it. Move the call to dm_suspended_md after dm_get_live_table, so that the device can't be suspended after the suspended state was tested.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f9c1bdf24615303d48a2d0fd629c88f3189563aa before 175ac0a6115400278d3900f5a04a58b17b3f6cd0; 37f53a2c60d03743e0eacf7a0c01c279776fef4e builds before 7a3385e97af2b6f485fef11e82d8c29adee4be93; from 37f53a2c60d03743e0eacf7a0c01c279776fef4e before d809a36692ee1394cac85ce6ba7cf8ea58da5812; 37f53a2c60d03743e0eacf7a0c01c279776fef4e builds before 24c405fdbe215c45e57bba672cc42859038491ee; d19bc1b4dd5f322980b1f05f79b2ea4f0db10920; from 6.12.34 before 6.12.75; from 6.15.3 before 6.16 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.12.34 before 6.12.75; from 6.15.3 before 6.18.14; from 6.19 before 6.19.4 | NVD |
References
- https://git.kernel.org/stable/c/175ac0a6115400278d3900f5a04a58b17b3f6cd0patch
- https://git.kernel.org/stable/c/7a3385e97af2b6f485fef11e82d8c29adee4be93patch
- https://git.kernel.org/stable/c/d809a36692ee1394cac85ce6ba7cf8ea58da5812patch
- https://git.kernel.org/stable/c/24c405fdbe215c45e57bba672cc42859038491eepatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.