Skip to main content

Linux Kernel EUVDEUVD-2026-27752

| CVE-2026-43192 MEDIUM
2026-05-06 Linux GHSA-3vfw-27w6-rr78
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.4 MEDIUM

Configuring dm-mpath paths and triggering path parsing requires privileged (root/admin) access, warranting PR:H; availability-only impact confirmed by description.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:03 vuln.today
CVSS changed
May 11, 2026 - 20:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dm mpath: Add missing dm_put_device when failing to get scsi dh name

When commit fd81bc5cca8f ("scsi: device_handler: Return error pointer in scsi_dh_attached_handler_name()") added code to fail parsing the path if scsi_dh_attached_handler_name() failed with -ENOMEM, it didn't clean up the reference to the path device that had just been taken. Fix this, and steamline the error paths of parse_path() a little.

AnalysisAI

Resource reference leak in the Linux kernel's dm-multipath (dm mpath) subsystem allows a local low-privileged user to trigger an availability impact against systems using multipath SCSI storage. Specifically, the parse_path() function fails to call dm_put_device() when scsi_dh_attached_handler_name() returns -ENOMEM during path parsing, leaving a dangling device reference that is never released. No public exploit exists and EPSS probability is 0.02%, placing this firmly in the low-exploitation-likelihood tier, but enterprise Linux systems with SAN-backed multipath storage are in scope. Vendor-released patches are available in Linux 6.19.6 and the 7.0 stable branch.

Technical ContextAI

The Linux kernel's device mapper multipath subsystem (dm mpath) manages I/O path failover and load balancing across multiple physical paths to a storage device. During path parsing in parse_path(), a reference to the target path device is acquired via dm_get_device(), after which scsi_dh_attached_handler_name() is called to retrieve the SCSI device handler name for the path. Commit fd81bc5cca8f introduced a code path that returns early if this call fails with -ENOMEM, but omitted the corresponding dm_put_device() cleanup, producing a reference count imbalance (CWE not formally assigned but aligns with CWE-772: Missing Release of Resource after Effective Lifetime). The affected CPE is cpe:2.3:a:linux:linux across all versions preceding the fix commits, specifically the fd81bc5cca8f..787bd63ee661 and fd81bc5cca8f..4aa5c37b7d80 ranges. The affected kernel versions include Linux 6.19 series prior to 6.19.6 and mainline prior to 7.0.

RemediationAI

The primary remediation is to upgrade to Linux kernel 6.19.6 or any mainline build at or after commit 787bd63ee661b0148ce8e1fde92b7afddd85c446 (stable tree 1) or 4aa5c37b7d8019f7296111c1add00e7214baae60 (stable tree 2), both available at https://git.kernel.org/stable/c/. Distributions such as Red Hat and SUSE should apply their respective kernel updates incorporating these commits. If an immediate kernel update is not feasible, a compensating control is to avoid SCSI device handler configurations that can trigger memory pressure (-ENOMEM) during dm-mpath path parsing - specifically, limiting or deferring dynamic path addition under low-memory conditions reduces the probability of hitting the error path. This workaround has the trade-off of reducing multipath redundancy during path reconfiguration events. Disabling dm-mpath entirely is not recommended as it eliminates storage HA, but is an option for systems where SAN redundancy is not required.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27752 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy