CVE-2026-46107 (GCVE-0-2026-46107)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:35 – Updated: 2026-08-05 12:29
VLAI
Title
dm-thin: fix metadata refcount underflow
Summary
In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared.
Assigner
Impacted products
Vendor Product Version
Linux Linux Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < b719d12cb94df345e9ad2715fd0abe9afcaeb111 (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < f49b41c9eb7c6ff00df27cd49cea210abbadd8ad (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < f06f6aededd792a754cd677c02b3d3016d868c2c (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < 12161e03d33afce781f68fa11cc6060538862fad (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < 323d252a4a378834e4fe68298ca61cfc5dd3a460 (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < 85311a585a26640760cd0f3349ab9f2905691044 (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < 5ec0debbcfd43596e32c1239e993de06a704e04c (git)
Affected: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 , < 09a65adc7d8bbfce06392cb6d375468e2728ead5 (git)
Create a notification for this product.
Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.88 , ≤ 6.12.* (semver)
Unaffected: 6.18.30 , ≤ 6.18.* (semver)
Unaffected: 7.0.7 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/persistent-data/dm-btree-remove.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b719d12cb94df345e9ad2715fd0abe9afcaeb111",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "f49b41c9eb7c6ff00df27cd49cea210abbadd8ad",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "f06f6aededd792a754cd677c02b3d3016d868c2c",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "12161e03d33afce781f68fa11cc6060538862fad",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "323d252a4a378834e4fe68298ca61cfc5dd3a460",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "85311a585a26640760cd0f3349ab9f2905691044",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "5ec0debbcfd43596e32c1239e993de06a704e04c",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            },
            {
              "lessThan": "09a65adc7d8bbfce06392cb6d375468e2728ead5",
              "status": "affected",
              "version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/persistent-data/dm-btree-remove.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-thin: fix metadata refcount underflow\n\nThere\u0027s a bug in dm-thin in the function rebalance_children. If the\ninternal btree node has one entry, the code tries to copy all btree\nentries from the node\u0027s child to the node itself and then decrement the\nchild\u0027s reference count.\n\nIf the child node is shared (it has reference count \u003e 1), we won\u0027t free\nit, so there would be two pointers to each of the grandchildren nodes.\nBut the reference counts of the grandchildren is not increased, thus the\nreference count doesn\u0027t match the number of pointers that point to the\ngrandchildren. This results in \"device mapper: space map common: unable\nto decrement block\" errors.\n\nFix this bug by incrementing reference counts on the grandchildren if the\nbtree node is shared."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is in the device-mapper thin-provisioning metadata layer, reached only via local block I/O (discard/TRIM) to a thin volume or local device-mapper ioctls \u2014 there is no network-facing path.\nAC:L - The bug arises during ordinary snapshot+removal workflows; an attacker controlling the operations (snapshots plus repeated removals/discards) reliably produces a single-entry internal node over a shared child, with no condition beyond their control.\nPR:L - Although pool/snapshot setup needs CAP_SYS_ADMIN, the triggering removal is reachable through discard/TRIM I/O on a snapshotted thin volume \u2014 e.g. an unprivileged user deleting files on a discard-mounted fs or a delegated volume in a multi-tenant/container deployment.\nUI:N - The attacker triggers the corruption directly through their own discard/removal operations; no action by a separate victim is required.\nS:U - The corruption stays within the kernel\u0027s storage subsystem and the affected thin pool; it does not cross into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - The refcount underflow prematurely frees still-referenced blocks that get reallocated, so reads through the surviving snapshot reference can disclose whole reallocated blocks of unrelated (potentially other tenants\u0027) data.\nI:H - Double-allocated blocks and corrupted btree/space-map metadata allow modification of data belonging to other thin volumes/snapshots and corruption of pool metadata structures.\nA:H - The underflow produces \"unable to decrement block\" errors that abort the metadata transaction and force the pool read-only/fail, and corrupted metadata can crash the kernel on subsequent validation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:40.825Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b719d12cb94df345e9ad2715fd0abe9afcaeb111"
        },
        {
          "url": "https://git.kernel.org/stable/c/f49b41c9eb7c6ff00df27cd49cea210abbadd8ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/f06f6aededd792a754cd677c02b3d3016d868c2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/12161e03d33afce781f68fa11cc6060538862fad"
        },
        {
          "url": "https://git.kernel.org/stable/c/323d252a4a378834e4fe68298ca61cfc5dd3a460"
        },
        {
          "url": "https://git.kernel.org/stable/c/85311a585a26640760cd0f3349ab9f2905691044"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ec0debbcfd43596e32c1239e993de06a704e04c"
        },
        {
          "url": "https://git.kernel.org/stable/c/09a65adc7d8bbfce06392cb6d375468e2728ead5"
        }
      ],
      "title": "dm-thin: fix metadata refcount underflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46107",
    "datePublished": "2026-05-28T09:35:13.051Z",
    "dateReserved": "2026-05-13T15:03:33.098Z",
    "dateUpdated": "2026-08-05T12:29:40.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46107",
      "date": "2026-08-16",
      "epss": "0.00129",
      "percentile": "0.02975"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:48:15.000Z",
      "cve": "CVE-2026-46107",
      "id": "msrc_CVE-2026-46107",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "dm-thin: fix metadata refcount underflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46107.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46107\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-28T10:16:26.063\",\"lastModified\":\"2026-06-25T21:19:11.207\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm-thin: fix metadata refcount underflow\\n\\nThere\u0027s a bug in dm-thin in the function rebalance_children. If the\\ninternal btree node has one entry, the code tries to copy all btree\\nentries from the node\u0027s child to the node itself and then decrement the\\nchild\u0027s reference count.\\n\\nIf the child node is shared (it has reference count \u003e 1), we won\u0027t free\\nit, so there would be two pointers to each of the grandchildren nodes.\\nBut the reference counts of the grandchildren is not increased, thus the\\nreference count doesn\u0027t match the number of pointers that point to the\\ngrandchildren. This results in \\\"device mapper: space map common: unable\\nto decrement block\\\" errors.\\n\\nFix this bug by incrementing reference counts on the grandchildren if the\\nbtree node is shared.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/persistent-data/dm-btree-remove.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3241b1d3e0aaafbfcd320f4d71ade629728cc4f4\",\"lessThan\":\"b719d12cb94df345e9ad2715fd0abe9afcaeb111\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3241b1d3e0aaafbfcd320f4d71ade629728cc4f4\",\"lessThan\":\"f49b41c9eb7c6ff00df27cd49cea210abbadd8ad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3241b1d3e0aaafbfcd320f4d71ade629728cc4f4\",\"lessThan\":\"f06f6aededd792a754cd677c02b3d3016d868c2c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3241b1d3e0aaafbfcd320f4d71ade629728cc4f4\",\"lessThan\":\"12161e03d33afce781f68fa11cc6060538862fad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3241b1d3e0aaafbfcd320f4d71ade629728cc4f4\",\"lessThan\":\"323d252a4a378834e4fe68298ca61cfc5dd3a460\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3241b1d3e0aaafbfcd320f4d71ade629728cc4f4\",\"lessThan\":\"85311a585a26640760cd0f3349ab9f2905691044\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3241b1d3e0aaafbfcd320f4d71ade629728cc4f4\",\"lessThan\":\"5ec0debbcfd43596e32c1239e993de06a704e04c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3241b1d3e0aaafbfcd320f4d71ade629728cc4f4\",\"lessThan\":\"09a65adc7d8bbfce06392cb6d375468e2728ead5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/persistent-data/dm-btree-remove.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.88\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.30\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.7\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-191\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2\",\"versionEndExcluding\":\"5.10.259\",\"matchCriteriaId\":\"AC53F596-A57D-4444-90F4-98E548AF23A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.209\",\"matchCriteriaId\":\"919C10A9-7951-4A74-BADD-C135A0A8D8B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"92385813-D91D-480D-83A1-F423D2CBB2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"A1A92866-F406-43B5-B2D1-CFC274753E9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.88\",\"matchCriteriaId\":\"5AFBE0EC-CCDF-4207-AE92-ABF958125CA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.30\",\"matchCriteriaId\":\"BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.7\",\"matchCriteriaId\":\"D0893CA7-9AE6-4DFE-AC75-48967D73AD8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/09a65adc7d8bbfce06392cb6d375468e2728ead5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/12161e03d33afce781f68fa11cc6060538862fad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/323d252a4a378834e4fe68298ca61cfc5dd3a460\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ec0debbcfd43596e32c1239e993de06a704e04c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/85311a585a26640760cd0f3349ab9f2905691044\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b719d12cb94df345e9ad2715fd0abe9afcaeb111\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f06f6aededd792a754cd677c02b3d3016d868c2c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f49b41c9eb7c6ff00df27cd49cea210abbadd8ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T21:31:10+00:00",
      "cve": "CVE-2026-46107",
      "id": "CVE-2026-46107",
      "initial_release_date": "2026-05-28T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm-thin: fix metadata refcount underflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46107.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:18:05Z",
      "cve": "CVE-2026-46107",
      "id": "CVE-2026-46107",
      "initial_release_date": "2026-05-29T01:17:07Z",
      "product_status:known_affected": "295",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46107",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46107.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Loading…