Skip to main content

Linux Kernel EUVDEUVD-2026-32462

| CVE-2026-46079 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-8v7w-qf4c-rv8c
Denial Of Service Linux Null Pointer Dereference Red Hat Canonical Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Write to /sys/bus/rbd/add_single_major
  2. Delivery
    Trigger device_add_disk() failure after device_add() succeeds
  3. Exploit
    Double rbd_free_disk() corrupts blk-mq tag set
  4. Execution
    Null pointer dereference in __blk_mq_free_map_and_rqs()
  5. Impact
    Kernel panic crashes host system

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires three concurrent conditions: (1) the target kernel must be compiled with CONFIG_BLK_DEV_RBD enabled, as the vulnerable code path only exists when Ceph RBD support is built in; (2) the attacker must have write access to the /sys/bus/rbd/add_single_major sysfs interface, which in standard Linux configurations requires CAP_SYS_ADMIN or root - this is a significant limiting factor that the published PR:L metric may understate; and (3) device_add_disk() must fail during the RBD image mapping operation, which requires a triggering condition such as genuine memory exhaustion, resource limits, or kernel allocation failure in the __add_disk() code range. Exploitation is NOT possible remotely, NOT possible without RBD kernel support, and NOT possible without the specific error-path condition being hit. The non-default nature of the failure trigger (device_add_disk() returning an error) means this cannot be reliably triggered without either memory pressure manipulation or kernel debug features like CONFIG_FAILSLAB.
Impact

Real-world risk is low-to-moderate despite the kernel-crash severity. The CVSS 3.1 score of 5.5 (Medium) reflects the local attack vector (AV:L) and low-privilege requirement (PR:L), which gates exploitation to processes already on the system with sysfs write access. The EPSS score of 0.02% at the 5th percentile is consistent with the niche exploitation conditions: an attacker must trigger a specific failure in device_add_disk() rather than exploit a simple memory corruption primitively reachable over the network. There is no CISA KEV listing and no public proof-of-concept known at time of analysis. However, the Availability impact is High (A:H) because successful exploitation crashes the kernel, taking down all workloads on the host - a meaningful impact on Ceph-connected production infrastructure. One caveat: the published CVSS vector assigns PR:L, but writing to /sys/bus/rbd/add_single_major typically requires CAP_SYS_ADMIN or root in standard Linux configurations, which would more accurately be PR:H - defenders should verify their kernel's sysfs permission model before treating this as a low-privilege risk.
Exploit ScenarioDerived

A local attacker or compromised process with sufficient privilege to write to /sys/bus/rbd/add_single_major attempts to map a Ceph RBD image under conditions of memory pressure or induced allocation failure, causing device_add_disk() to return an error after device_add() has already succeeded. The resulting double call to rbd_free_disk() corrupts the blk-mq tag set state, and the subsequent blk_mq_free_tag_set() call dereferences a null pointer in __blk_mq_free_map_and_rqs(), producing a kernel general protection fault and crashing the host. No public proof-of-concept exploit exists, but the researchers reproduced this deterministically using CONFIG_FAILSLAB with fail-nth=4 on an unpatched v7.0 kernel.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 24, 2026

Null-pointer dereference in the Linux kernel's RBD (RADOS Block Device) subsystem crashes the kernel when device_add_disk() fails after device_add() has already succeeded. Systems running Linux kernel with Ceph RBD support enabled are affected across multiple stable branches from the introduction of commit 27c97abc30e2 through the patched releases. A local attacker with sufficient privileges to map RBD images via the sysfs interface can trigger this error path to cause a kernel panic and system-wide denial of service. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.02% at the 5th percentile signals negligible weaponization probability.

RemediationAI

The primary fix is to upgrade to a patched stable kernel release: 6.6.140, 6.12.86, 7.0.4, 6.18.27, or 7.1-rc1. Upstream patch commits are available at https://git.kernel.org/stable/c/059fb7656723c1b77c2fc0e64b7aa99d6bb65e8e, https://git.kernel.org/stable/c/2f4809a879f0750c7790bbeeae86c9505797a06f, https://git.kernel.org/stable/c/564cd8f4aeb9a938e Oakland4aeb9a938e470c5c91922fd02e4d41acc, https://git.kernel.org/stable/c/ad0126ffcba8777109852979eaaa6dca6703abdb, and https://git.kernel.org/stable/c/d1fef92e414433ca7b89abf85cb0df42b8d475eb. As a compensating control on systems where immediate kernel upgrade is not possible, disable Ceph RBD device mapping by removing the rbd kernel module (rmmod rbd) or preventing its loading via a modprobe blacklist entry - this eliminates the vulnerable code path entirely but also disables all Ceph block storage functionality, which is a significant trade-off for environments relying on RBD-backed volumes. Restricting write access to /sys/bus/rbd/ via udev rules or filesystem permissions provides additional defense-in-depth but does not eliminate the underlying bug if other privileged processes legitimately use the interface.

Affected VersionsENISA

Linux 27c97abc30e2b9ad2288977c0ecbef4d50553f57 <564cd8f4aeb9a938e470c5c91922fd02e4d41acc
Linux patch: 6.6.140
Linux 27c97abc30e2b9ad2288977c0ecbef4d50553f57 <ad0126ffcba8777109852979eaaa6dca6703abdb
Linux 5.16
Linux patch: 6.12.86
Linux patch: 7.0.4
Linux patch: 6.18.27
Linux patch: 0
Linux 27c97abc30e2b9ad2288977c0ecbef4d50553f57 <d1fef92e414433ca7b89abf85cb0df42b8d475eb
Linux 27c97abc30e2b9ad2288977c0ecbef4d50553f57 <2f4809a879f0750c7790bbeeae86c9505797a06f
Linux patch: 7.1-rc1
Linux 27c97abc30e2b9ad2288977c0ecbef4d50553f57 <059fb7656723c1b77c2fc0e64b7aa99d6bb65e8e

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the Linux kernel's rbd (RADOS Block Device) driver, which implements Ceph block storage support. The affected code path is in do_rbd_add(), responsible for device registration: it calls device_add() to publish the sysfs device node and then calls device_add_disk() to register the block device with the block-multi-queue (blk-mq) subsystem. CWE-476 (Null Pointer Dereference) describes the root cause: when device_add_disk() fails, the error path incorrectly calls rbd_free_disk() directly and then falls through to rbd_dev_device_release(), which calls rbd_free_disk() a second time. This double teardown leaves the blk-mq tag set in an invalid state with a null queue pointer, triggering a general protection fault in __blk_mq_free_map_and_rqs() → blk_mq_free_tag_set(). The CPE string cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* confirms Linux kernel as the sole affected product. The bug was discovered by an experimental kernel memory-management analysis tool and reproduced on v7.0 with KASAN and CONFIG_FAILSLAB under a QEMU/x86_64 environment with a real Ceph backend.

Know when Canonical gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.1 MEDIUM

Requires CAP_SYS_ADMIN for sysfs write access (PR:H) and a specific device_add_disk() failure condition (AC:H); purely availability impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 24, 2026 - 17:22 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

rbd: fix null-ptr-deref when device_add_disk() fails

do_rbd_add() publishes the device with device_add() before calling device_add_disk(). If device_add_disk() fails after device_add() succeeds, the error path calls rbd_free_disk() directly and then later falls through to rbd_dev_device_release(), which calls rbd_free_disk() again. This double teardown can leave blk-mq cleanup operating on invalid state and trigger a null-ptr-deref in __blk_mq_free_map_and_rqs(), reached from blk_mq_free_tag_set().

Fix this by following the normal remove ordering: call device_del() before rbd_dev_device_release() when device_add_disk() fails after device_add(). That keeps the teardown sequence consistent and avoids re-entering disk cleanup through the wrong path.

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available.

We reproduced the bug on v7.0 with a real Ceph backend and a QEMU x86_64 guest booted with KASAN and CONFIG_FAILSLAB enabled. The reproducer confines failslab injections to the __add_disk() range and injects fail-nth while mapping an RBD image through /sys/bus/rbd/add_single_major.

On the unpatched kernel, fail-nth=4 reliably triggered the fault:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 273 Comm: bash Not tainted 7.0.0-01247-gd60bc1401583 #6 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:__blk_mq_free_map_and_rqs+0x8c/0x240 Code: 00 00 48 8b 6b 60 41 89 f4 49 c1 e4 03 4c 01 e5 45 85 ed 0f 85 0a 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 e9 48 c1 e9 03 <80> 3c 01 00 0f 85 31 01 00 00 4c 8b 6d 00 4d 85 ed 0f 84 e2 00 00 RSP: 0018:ff1100000ab0fac8 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ff1100000c4806a0 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000000 RDI: ff1100000c4806f4 RBP: 0000000000000000 R08: 0000000000000001 R09: ffe21c000189001b R10: ff1100000c4800df R11: ff1100006cf37be0 R12: 0000000000000000 R13: 0000000000000000 R14: ff1100000c480700 R15: ff1100000c480004 FS: 00007f0fbe8fe740(0000) GS:ff110000e5851000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe53473b2e0 CR3: 0000000012eef000 CR4: 00000000007516f0 PKRU: 55555554 Call Trace: <TASK> blk_mq_free_tag_set+0x77/0x460 do_rbd_add+0x1446/0x2b80 ? __pfx_do_rbd_add+0x10/0x10 ? lock_acquire+0x18c/0x300 ? find_held_lock+0x2b/0x80 ? sysfs_file_kobj+0xb6/0x1b0 ? __pfx_sysfs_kf_write+0x10/0x10 kernfs_fop_write_iter+0x2f4/0x4a0 vfs_write+0x98e/0x1000 ? expand_files+0x51f/0x850 ? __pfx_vfs_write+0x10/0x10 ksys_write+0xf2/0x1d0 ? __pfx_ksys_write+0x10/0x10 do_syscall_64+0x115/0x690 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0fbea15907 Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007ffe22346ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f0fbea15907 RDX: 0000000000000058 RSI: 0000563ace6c0ef0 RDI: 0000000000000001 RBP: 0000563ace6c0ef0 R08: 0000563ace6c0ef0 R09: 6b6435726d694141 R10: 5250337279762f78 R11: 0000000000000246 R12: 0000000000000058 R13: 00007f0fbeb1c780 R14: ff1100000c480700 R15: ff1100000c480004 </TASK>

With this fix applied, rerunning the reproducer over fail-nth=1..256 yields no KASAN reports.

[ idryomov: rename err_out_device_del -> err_out_device ]

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel runs the vast majority of servers, cloud, and embedded infrastructure worldwide
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.158 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.144 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.173 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.144 Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://ubuntu.com/security/notices/USN-8489-1 ADVISORY https://vuldb.com/vuln/366305 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22100/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22108/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22137/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22140/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2482/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2591/ REF https://git.kernel.org/stable/c/059fb7656723c1b77c2fc0e64b7aa99d6bb65e8e REF https://git.kernel.org/stable/c/2f4809a879f0750c7790bbeeae86c9505797a06f REF https://git.kernel.org/stable/c/564cd8f4aeb9a938e470c5c91922fd02e4d41acc REF https://git.kernel.org/stable/c/78bd0c143dea4b7a4c23c13356987ca0eafb442e REF https://git.kernel.org/stable/c/ad0126ffcba8777109852979eaaa6dca6703abdb REF https://git.kernel.org/stable/c/d1fef92e414433ca7b89abf85cb0df42b8d475eb

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy