CVE-2026-46107: linux Integer Underflow (Wrap or Wraparound)
Vulnerability summary
CVE-2026-46107 is a high (CVSS 7.8) Integer Underflow (Wrap or Wraparound) vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 51 · Related 51Timeline
- 28-05-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
0.00 pp
From 0.13% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
- CWE-667Improper LockingThe product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Affected systems
Ubuntu166 products
- linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-136.136 | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1061.64 | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, < b719d12cb94df345e9ad2715fd0abe9afcaeb111 | ≥ 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, < f49b41c9eb7c6ff00df27cd49cea210abbadd8ad | ≥ 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, < f06f6aededd792a754cd677c02b3d3016d868c2c | ≥ 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, < 12161e03d33afce781f68fa11cc6060538862fad | ≥ 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, < 323d252a4a378834e4fe68298ca61cfc5dd3a460 | ≥ 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, < 85311a585a26640760cd0f3349ab9f2905691044 | ≥ 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, < 5ec0debbcfd43596e32c1239e993de06a704e04c | ≥ 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4, < 09a65adc7d8bbfce06392cb6d375468e2728ead5 | 3.2
- linux_kernel≥ 3.2, < 5.10.259 | ≥ 5.11, < 5.15.209 | ≥ 5.16, < 6.1.175 | ≥ 6.2, < 6.6.140 | ≥ 6.7, < 6.12.88 | ≥ 6.13, < 6.18.30 | ≥ 6.19, < 7.0.7 | 7.1:rc1
Debian1 product
- linux< 6.1.176-1 | < 6.12.88-1 | < 7.0.7-1
3 vendors · 169 products
