CVE-2026-46327: dm: fix unlocked test for dm_suspended_md

Synopsis

A race condition in the Linux kernel's device mapper (dm) subsystem affects the dm_blk_report_zones function. The function tests whether a device-mapper target is suspended without holding a lock, allowing the device to be suspended between the check and subsequent operations, which is a classic time-of-check to time-of-use (TOCTOU) bug. Successful exploitation by a local attacker with a low-privilege account allows full read, write, and crash access to the affected system. A patched-image rebuild at the fixed kernel versions is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to attempt exploitation; no administrative rights are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the race condition independently.

• Attack complexityDetail

  The exploit is relatively reliable and does not depend on unusual environmental conditions, though it requires timing a suspension event against the unlocked check window.

Blast Radius

• A successful attacker reads arbitrary kernel memory, including stored credentials, session tokens, and sensitive process data.
• A successful attacker writes to kernel memory structures, enabling persistent modification of running kernel state or privilege escalation.
• A successful attacker crashes the affected host by corrupting device-mapper state, causing a kernel panic and full service disruption.
• Any containerized workload sharing the host kernel is exposed to the same impact, since the vulnerability is in the host kernel's device mapper subsystem.