Skip to content
Heist/ feed
High

dm: clear cloned request bio pointer when last clone bio completes

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: dm: clear cloned request bio pointer when last clone bio completes Stale rq->bio values have been observed to cause double-initialization of cloned bios in request-based device-mapper targets, leading to use-after-free and double-free scenarios. One such case occurs when using dm-multipath on top of a PCIe NVMe namespace, where cloned request bios are freed during blk_complete_request(), but rq->bio is left intact. Subsequent clone teardown then attempts to free the same bios again via blk_rq_unprep_clone(). The resulting double-free path looks like: nvme_pci_complete_batch() nvme_complete_batch() blk_mq_end_request_batch() blk_complete_request() // called on a DM clone request bio_endio() // first free of all clone bios ... rq->end_io() // end_clone_request() dm_complete_request(tio->orig) dm_softirq_done() dm_done() dm_end_request() blk_rq_unprep_clone() // second free of clone bios Fix this by clearing the clone request's bio pointer when the last cloned bio completes, ensuring that later teardown paths do not attempt to free already-released bios.

Announced Source revision 1
Original source ↗

CVE-2026-43278

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-43278

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
        "lessThan": "8d9ddad561136f7e6a9346767bf97b4d79e38e67",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
        "lessThan": "7daf279c674d515fb22a727a7bbc92aeb35c5442",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
        "lessThan": "e2e738e8dfbbf83bd2bae0467ec4420cc52da42a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
        "lessThan": "b1c1a2637ebd675aa2d71fee8c70da8791d73850",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
        "lessThan": "83d72091804600ead96dc9e9f518ea56cb4942f6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
        "lessThan": "fb8a6c18fb9a6561f7a15b58b272442b77a242dd",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/md/dm-rq.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.1"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.1",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.165",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.128",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.75",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.16",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19.6",
        "versionType": "semver",
        "lessThanOrEqual": "6.19.*"
      },
      {
        "status": "unaffected",
        "version": "7.0",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/md/dm-rq.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-43278

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#40052 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement