Linux Kernel CVE-2026-53128

DRBD (Distributed Replicated Block Device) is a Linux kernel module enabling synchronous block-level replication across cluster nodes, commonly used in high-availability storage configurations. Read-Copy-Update (RCU) is the kernel's lock-free synchronization primitive: rcu_read_lock() and rcu_read_unlock() must be balanced, as an unmatched rcu_read_unlock() decrements the RCU reader count prematurely, potentially signaling that a grace period has elapsed before it actually has. This can permit memory reclamation of data structures still in use, leading to use-after-free conditions or kernel crashes. The Clang thread-safety analyzer statically detected this imbalance in drbd_adm_dump_devices(), the netlink handler that enumerates DRBD device state for administrative tools. CPE data confirms the affected product as cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across multiple LTS branches. The CWE is not formally assigned, but the root cause class is a resource lifecycle management error (lock imbalance), analogous to CWE-667 (Improper Locking).