CVE-2026-43278 (GCVE-0-2026-43278)
Vulnerability from cvelistv5 – Published: 2026-05-06 11:29 – Updated: 2026-08-05 12:27
VLAI
EPSS
VEX
Title
dm: clear cloned request bio pointer when last clone bio completes
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm: clear cloned request bio pointer when last clone bio completes
Stale rq->bio values have been observed to cause double-initialization of
cloned bios in request-based device-mapper targets, leading to
use-after-free and double-free scenarios.
One such case occurs when using dm-multipath on top of a PCIe NVMe
namespace, where cloned request bios are freed during
blk_complete_request(), but rq->bio is left intact. Subsequent clone
teardown then attempts to free the same bios again via
blk_rq_unprep_clone().
The resulting double-free path looks like:
nvme_pci_complete_batch()
nvme_complete_batch()
blk_mq_end_request_batch()
blk_complete_request() // called on a DM clone request
bio_endio() // first free of all clone bios
...
rq->end_io() // end_clone_request()
dm_complete_request(tio->orig)
dm_softirq_done()
dm_done()
dm_end_request()
blk_rq_unprep_clone() // second free of clone bios
Fix this by clearing the clone request's bio pointer when the last cloned
bio completes, ensuring that later teardown paths do not attempt to free
already-released bios.
Severity
7.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
ab3e1d3bbab9e973aeb4dd4603251578658a47ff , < 8d9ddad561136f7e6a9346767bf97b4d79e38e67
(git)
Affected: ab3e1d3bbab9e973aeb4dd4603251578658a47ff , < 7daf279c674d515fb22a727a7bbc92aeb35c5442 (git) Affected: ab3e1d3bbab9e973aeb4dd4603251578658a47ff , < e2e738e8dfbbf83bd2bae0467ec4420cc52da42a (git) Affected: ab3e1d3bbab9e973aeb4dd4603251578658a47ff , < b1c1a2637ebd675aa2d71fee8c70da8791d73850 (git) Affected: ab3e1d3bbab9e973aeb4dd4603251578658a47ff , < 83d72091804600ead96dc9e9f518ea56cb4942f6 (git) Affected: ab3e1d3bbab9e973aeb4dd4603251578658a47ff , < fb8a6c18fb9a6561f7a15b58b272442b77a242dd (git) |
guessed | |
| Linux | Linux |
Affected:
6.1
Unaffected: 0 , < 6.1 (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-rq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d9ddad561136f7e6a9346767bf97b4d79e38e67",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "7daf279c674d515fb22a727a7bbc92aeb35c5442",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "e2e738e8dfbbf83bd2bae0467ec4420cc52da42a",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "b1c1a2637ebd675aa2d71fee8c70da8791d73850",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "83d72091804600ead96dc9e9f518ea56cb4942f6",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "fb8a6c18fb9a6561f7a15b58b272442b77a242dd",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-rq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: clear cloned request bio pointer when last clone bio completes\n\nStale rq-\u003ebio values have been observed to cause double-initialization of\ncloned bios in request-based device-mapper targets, leading to\nuse-after-free and double-free scenarios.\n\nOne such case occurs when using dm-multipath on top of a PCIe NVMe\nnamespace, where cloned request bios are freed during\nblk_complete_request(), but rq-\u003ebio is left intact. Subsequent clone\nteardown then attempts to free the same bios again via\nblk_rq_unprep_clone().\n\nThe resulting double-free path looks like:\n\n nvme_pci_complete_batch()\n nvme_complete_batch()\n blk_mq_end_request_batch()\n blk_complete_request() // called on a DM clone request\n bio_endio() // first free of all clone bios\n ...\n rq-\u003eend_io() // end_clone_request()\n dm_complete_request(tio-\u003eorig)\n dm_softirq_done()\n dm_done()\n dm_end_request()\n blk_rq_unprep_clone() // second free of clone bios\n\nFix this by clearing the clone request\u0027s bio pointer when the last cloned\nbio completes, ensuring that later teardown paths do not attempt to free\nalready-released bios."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable request-based device-mapper path is reached by local block I/O, such as reads or writes to a filesystem backed by dm-multipath. It is not itself a network protocol handler, even though network services may indirectly generate disk I/O.\nAC:L - On an affected request-based dm-multipath stack over blk-mq/NVMe, ordinary I/O can drive the deterministic completion path that frees the clone bios and then tears down the clone. No attacker-uncontrolled race is required.\nPR:L - Creating or reconfiguring DM devices requires CAP_SYS_ADMIN, but triggering the bug only requires the ability to issue I/O to an existing affected mapped device, for example through files the local user can read or write. Thus a basic unprivileged local user can reach the vulnerable path.\nUI:N - The attacker can trigger the I/O directly through their own syscalls. No separate victim action is required.\nS:U - The impact remains within the kernel/host security authority. This is a standard local kernel memory-corruption issue, not a VM escape or cross-authority boundary bypass.\nC:H - The stale cloned bio pointer causes use-after-free/double-free of kernel heap objects from the DM bioset. Per kernel CVSS guidance, such memory corruption is treated as capable of enabling high-impact information disclosure.\nI:H - The double-free/use-after-free can corrupt allocator state or allow overlapping/reused kernel objects, which is defensibly exploitable for arbitrary memory modification or code execution. Per guidance, UAF/double-free memory corruption warrants high integrity impact.\nA:H - Even without full exploitation, the double-free/use-after-free can trigger kernel memory corruption, oops, or panic during I/O completion. Repeated attacker-controlled I/O can repeatedly hit the vulnerable path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:00.162Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d9ddad561136f7e6a9346767bf97b4d79e38e67"
},
{
"url": "https://git.kernel.org/stable/c/7daf279c674d515fb22a727a7bbc92aeb35c5442"
},
{
"url": "https://git.kernel.org/stable/c/e2e738e8dfbbf83bd2bae0467ec4420cc52da42a"
},
{
"url": "https://git.kernel.org/stable/c/b1c1a2637ebd675aa2d71fee8c70da8791d73850"
},
{
"url": "https://git.kernel.org/stable/c/83d72091804600ead96dc9e9f518ea56cb4942f6"
},
{
"url": "https://git.kernel.org/stable/c/fb8a6c18fb9a6561f7a15b58b272442b77a242dd"
}
],
"title": "dm: clear cloned request bio pointer when last clone bio completes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43278",
"datePublished": "2026-05-06T11:29:00.193Z",
"dateReserved": "2026-05-01T14:12:55.998Z",
"dateUpdated": "2026-08-05T12:27:00.162Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-43278",
"date": "2026-09-29",
"epss": "0.00171",
"percentile": "0.05793"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-rq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d9ddad561136f7e6a9346767bf97b4d79e38e67",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "7daf279c674d515fb22a727a7bbc92aeb35c5442",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "e2e738e8dfbbf83bd2bae0467ec4420cc52da42a",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "b1c1a2637ebd675aa2d71fee8c70da8791d73850",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "83d72091804600ead96dc9e9f518ea56cb4942f6",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "fb8a6c18fb9a6561f7a15b58b272442b77a242dd",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-rq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "96EF3286-5BCE-4D88-B8C9-4292E5BA7A18",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: clear cloned request bio pointer when last clone bio completes\n\nStale rq-\u003ebio values have been observed to cause double-initialization of\ncloned bios in request-based device-mapper targets, leading to\nuse-after-free and double-free scenarios.\n\nOne such case occurs when using dm-multipath on top of a PCIe NVMe\nnamespace, where cloned request bios are freed during\nblk_complete_request(), but rq-\u003ebio is left intact. Subsequent clone\nteardown then attempts to free the same bios again via\nblk_rq_unprep_clone().\n\nThe resulting double-free path looks like:\n\n nvme_pci_complete_batch()\n nvme_complete_batch()\n blk_mq_end_request_batch()\n blk_complete_request() // called on a DM clone request\n bio_endio() // first free of all clone bios\n ...\n rq-\u003eend_io() // end_clone_request()\n dm_complete_request(tio-\u003eorig)\n dm_softirq_done()\n dm_done()\n dm_end_request()\n blk_rq_unprep_clone() // second free of clone bios\n\nFix this by clearing the clone request\u0027s bio pointer when the last cloned\nbio completes, ensuring that later teardown paths do not attempt to free\nalready-released bios."
}
],
"id": "CVE-2026-43278",
"lastModified": "2026-06-17T10:49:17.837",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-05-06T12:16:49.213",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/7daf279c674d515fb22a727a7bbc92aeb35c5442"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/83d72091804600ead96dc9e9f518ea56cb4942f6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/8d9ddad561136f7e6a9346767bf97b4d79e38e67"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/b1c1a2637ebd675aa2d71fee8c70da8791d73850"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/e2e738e8dfbbf83bd2bae0467ec4420cc52da42a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/fb8a6c18fb9a6561f7a15b58b272442b77a242dd"
},
{
"source": "nvd@nist.gov",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/3d746b639be4b4f5cd8ce2b06aa52dc443f50edc"
},
{
"source": "nvd@nist.gov",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/9a95b98202113045bc1a5bcb30388a500f25e050"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-415"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-07-02T19:37:21+00:00",
"cve": "CVE-2026-43278",
"id": "CVE-2026-43278",
"initial_release_date": "2026-05-06T00:00:00+00:00",
"product_status:known_affected": "260",
"product_status:known_not_affected": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: dm: clear cloned request bio pointer when last clone bio completes",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43278.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-16T23:35:41Z",
"cve": "CVE-2026-43278",
"id": "CVE-2026-43278",
"initial_release_date": "2026-05-09T02:39:48Z",
"product_status:first_fixed": "2",
"product_status:known_affected": "424",
"product_status:known_not_affected": "296",
"product_status:recommended": "252",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-43278",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43278.json",
"version": "8"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…