CVE-2026-46107: dm-thin: fix metadata refcount underflow

Synopsis

A metadata refcount underflow bug affects dm-thin, the Linux kernel's thin-provisioning device mapper target. The flaw is reachable locally by a low-privileged user and stems from incorrect reference-count handling in the rebalance_children function when a shared internal btree node is processed. Successful exploitation corrupts storage metadata, giving an attacker the ability to read, modify, or destroy data managed by affected dm-thin volumes. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable code path.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the flaw without involving another user.

• Attack complexityDetail

  Exploit conditions are straightforward and do not rely on race conditions or specific memory layout, making the attack reliable and repeatable.

Blast Radius

• An attacker reads data stored on dm-thin volumes, including file contents and metadata that may contain sensitive application or user data.
• An attacker modifies persisted data on affected thin-provisioned volumes by corrupting btree metadata, altering stored blocks.
• Reference-count underflow causes "unable to decrement block" errors that destabilize the storage layer and crash or disable affected dm-thin volumes.
• Storage metadata corruption can spread across shared snapshots and thin devices backed by the same pool, widening the scope of damage beyond a single volume.