CVE-2026-46327

HighCVSS 7.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dm: fix unlocked test for dm_suspended_md

The function dm_blk_report_zones tests if the device is suspended with the "dm_suspended_md" call. However, this function is called without holding any locks, so the device may be suspended just after it.

Move the call to dm_suspended_md after dm_get_live_table, so that the device can't be suspended after the suspended state was tested.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
Linux	Linux	>= f9c1bdf24615303d48a2d0fd629c88f3189563aa, < 175ac0a6115400278d3900f5a04a58b17b3f6cd0; >= 37f53a2c60d03743e0eacf7a0c01c279776fef4e, < 7a3385e97af2b6f485fef11e82d8c29adee4be93; >= 37f53a2c60d03743e0eacf7a0c01c279776fef4e, < d809a36692ee1394cac85ce6ba7cf8ea58da5812; >= 37f53a2c60d03743e0eacf7a0c01c279776fef4e, < 24c405fdbe215c45e57bba672cc42859038491ee; d19bc1b4dd5f322980b1f05f79b2ea4f0db10920; >= 6.12.34, < 6.12.75; >= 6.15.3, < 6.16
Linux	Linux	6.16

References

Timeline

Published: Jun 9, 2026
Last modified: Oct 19, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-463287.3In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an CVE-2026-463295.5In the Linux kernel, the following vulnerability has been resolved: erofs: handle end of filesystem properly for file-backed mounts I/O re CVE-2026-46333.7A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizati CVE-2026-463307.8In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd42 CVE-2026-463317.8In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_CVE-2026-463328.0In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound bootloader receive buffering cc1352_boot CVE-2026-463337.1In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a t CVE-2026-463348.7OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vul CVE-2026-463367.1Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.CVE-2026-463375.3WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywher CVE-2026-463384.3PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a stri CVE-2026-4633910.09Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api