Linux Kernel EUVD-2026-35428

Attacker must have local code execution with low privileges (PR:L) on a Linux host where a zoned block device is exposed through the device-mapper subsystem and accessible to the attacker for issuing report-zones operations. The attacker must also be able to race the dm suspend transition window, which typically requires concurrent administrative activity or a way to influence suspend timing. Limiting factors: AV:L means no network exploitation, the bug only manifests on systems using dm with zoned devices (uncommon outside of SMR/ZNS deployments), and timing-dependent race exploitation is non-trivial in practice - substantially narrowing real-world impact despite the 7.8 CVSS.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local, low-complexity, low-privilege flaw with high CIA impact - typical scoring for kernel race conditions that could yield memory corruption. However, EPSS is extremely low at 0.02% (5th percentile) and there is no CISA KEV listing and no public exploit identified, indicating no observed real-world exploitation. Practical exploitability requires (a) a zoned block device exposed through device-mapper and (b) the ability to race the suspend path - narrow preconditions that meaningfully limit the attack surface despite the high CVSS. This is a legitimate stability/correctness fix that distributions should ship in routine kernel updates, but it is not an urgent emergency-patch candidate for most environments.

A local low-privileged user with the ability to issue blk-report-zones ioctls/sysfs reads against a device-mapper-managed zoned block device repeatedly races the dm suspend/resume path (triggered by another permitted operation or by a parallel admin action) to dereference a stale or partially torn-down mapping table. Successful exploitation could yield kernel memory corruption leading to local privilege escalation, information disclosure, or a kernel panic. No public PoC is known at time of analysis.