Описание
In the Linux kernel, the following vulnerability has been resolved:
dm btree remove: fix use after free in rebalance_children()
Move dm_tm_unlock() after dm_tm_dec().
A flaw was found in the Linux kernel's device-mapper subsystem. A local user could exploit this vulnerability to cause a Denial of Service (DoS) or potentially execute arbitrary code. The issue is caused by a use-after-free condition during B-tree node removal operations in the rebalance_children() function, where resources are unlocked before reference counts are decremented.
Отчет
This vulnerability is rated Low severity because triggering the issue requires local administrative privileges (such as root or CAP_SYS_ADMIN) to manage device-mapper persistent-data structures, limiting the attack surface. Standard Red Hat Enterprise Linux configurations do not grant unprivileged users access to manipulate device-mapper metadata or trigger B-tree rebalancing operations. Consequently, the flaw cannot be leveraged for privilege escalation and primarily presents a localized denial-of-service risk for already privileged contexts.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel | Affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | kernel | Fixed | RHSA-2026:65710 | 09.09.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | kernel | Fixed | RHSA-2026:65710 | 09.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.4 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalance_children() Move dm_tm_unlock() after dm_tm_dec().
In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalance_children() Move dm_tm_unlock() after dm_tm_dec().
In the Linux kernel, the following vulnerability has been resolved: d ...
In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalance_children() Move dm_tm_unlock() after dm_tm_dec().
Уязвимость компонента dm ядра операционной системы Linux, позволяющая нарушителю повысить привилегии в системе
EPSS
4.4 Medium
CVSS3