{"id":"CVE-2026-43278","state":"PUBLISHED","title":"dm: clear cloned request bio pointer when last clone bio completes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm: clear cloned request bio pointer when last clone bio completes\n\nStale rq->bio values have been observed to cause double-initialization of\ncloned bios in request-based device-mapper targets, leading to\nuse-after-free and double-free scenarios.\n\nOne such case occurs when using dm-multipath on top of a PCIe NVMe\nnamespace, where cloned request bios are freed during\nblk_complete_request(), but rq->bio is left intact. Subsequent clone\nteardown then attempts to free the same bios again via\nblk_rq_unprep_clone().\n\nThe resulting double-free path looks like:\n\n  nvme_pci_complete_batch()\n    nvme_complete_batch()\n      blk_mq_end_request_batch()\n        blk_complete_request()        // called on a DM clone request\n          bio_endio()                 // first free of all clone bios\n          ...\n        rq->end_io()                  // end_clone_request()\n          dm_complete_request(tio->orig)\n            dm_softirq_done()\n              dm_done()\n                dm_end_request()\n                  blk_rq_unprep_clone()  // second free of clone bios\n\nFix this by clearing the clone request's bio pointer when the last cloned\nbio completes, ensuring that later teardown paths do not attempt to free\nalready-released bios.","publishedAt":"2026-05-06T11:29:00.193Z","updatedAt":"2026-10-19T19:16:25.598Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"8d9ddad561136f7e6a9346767bf97b4d79e38e67","versionType":"git"},{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"7daf279c674d515fb22a727a7bbc92aeb35c5442","versionType":"git"},{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"e2e738e8dfbbf83bd2bae0467ec4420cc52da42a","versionType":"git"},{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"b1c1a2637ebd675aa2d71fee8c70da8791d73850","versionType":"git"},{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"83d72091804600ead96dc9e9f518ea56cb4942f6","versionType":"git"},{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"fb8a6c18fb9a6561f7a15b58b272442b77a242dd","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/dm-rq.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.1","versionType":"semver"},{"version":"6.1.165","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.128","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.75","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.16","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.6","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/dm-rq.c"]}],"references":["https://git.kernel.org/stable/c/8d9ddad561136f7e6a9346767bf97b4d79e38e67","https://git.kernel.org/stable/c/7daf279c674d515fb22a727a7bbc92aeb35c5442","https://git.kernel.org/stable/c/e2e738e8dfbbf83bd2bae0467ec4420cc52da42a","https://git.kernel.org/stable/c/b1c1a2637ebd675aa2d71fee8c70da8791d73850","https://git.kernel.org/stable/c/83d72091804600ead96dc9e9f518ea56cb4942f6","https://git.kernel.org/stable/c/fb8a6c18fb9a6561f7a15b58b272442b77a242dd"],"weaknesses":["CWE-415"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/43xxx/CVE-2026-43278.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43278","state":"PUBLISHED","datePublished":"2026-05-06T11:29:00.193Z","dateUpdated":"2026-10-19T19:16:25.598Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-01T14:12:55.998Z"},"containers":{"cna":{"title":"dm: clear cloned request bio pointer when last clone bio completes","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm: clear cloned request bio pointer when last clone bio completes\n\nStale rq->bio values have been observed to cause double-initialization of\ncloned bios in request-based device-mapper targets, leading to\nuse-after-free and double-free scenarios.\n\nOne such case occurs when using dm-multipath on top of a PCIe NVMe\nnamespace, where cloned request bios are freed during\nblk_complete_request(), but rq->bio is left intact. Subsequent clone\nteardown then attempts to free the same bios again via\nblk_rq_unprep_clone().\n\nThe resulting double-free path looks like:\n\n  nvme_pci_complete_batch()\n    nvme_complete_batch()\n      blk_mq_end_request_batch()\n        blk_complete_request()        // called on a DM clone request\n          bio_endio()                 // first free of all clone bios\n          ...\n        rq->end_io()                  // end_clone_request()\n          dm_complete_request(tio->orig)\n            dm_softirq_done()\n              dm_done()\n                dm_end_request()\n                  blk_rq_unprep_clone()  // second free of clone bios\n\nFix this by clearing the clone request's bio pointer when the last cloned\nbio completes, ensuring that later teardown paths do not attempt to free\nalready-released bios."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"8d9ddad561136f7e6a9346767bf97b4d79e38e67","versionType":"git"},{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"7daf279c674d515fb22a727a7bbc92aeb35c5442","versionType":"git"},{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"e2e738e8dfbbf83bd2bae0467ec4420cc52da42a","versionType":"git"},{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"b1c1a2637ebd675aa2d71fee8c70da8791d73850","versionType":"git"},{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"83d72091804600ead96dc9e9f518ea56cb4942f6","versionType":"git"},{"version":"ab3e1d3bbab9e973aeb4dd4603251578658a47ff","status":"affected","lessThan":"fb8a6c18fb9a6561f7a15b58b272442b77a242dd","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/dm-rq.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.1","versionType":"semver"},{"version":"6.1.165","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.128","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.75","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.16","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.6","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/dm-rq.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/8d9ddad561136f7e6a9346767bf97b4d79e38e67"},{"url":"https://git.kernel.org/stable/c/7daf279c674d515fb22a727a7bbc92aeb35c5442"},{"url":"https://git.kernel.org/stable/c/e2e738e8dfbbf83bd2bae0467ec4420cc52da42a"},{"url":"https://git.kernel.org/stable/c/b1c1a2637ebd675aa2d71fee8c70da8791d73850"},{"url":"https://git.kernel.org/stable/c/83d72091804600ead96dc9e9f518ea56cb4942f6"},{"url":"https://git.kernel.org/stable/c/fb8a6c18fb9a6561f7a15b58b272442b77a242dd"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable request-based device-mapper path is reached by local block I/O, such as reads or writes to a filesystem backed by dm-multipath. It is not itself a network protocol handler, even though network services may indirectly generate disk I/O.\nAC:L - On an affected request-based dm-multipath stack over blk-mq/NVMe, ordinary I/O can drive the deterministic completion path that frees the clone bios and then tears down the clone. No attacker-uncontrolled race is required.\nPR:L - Creating or reconfiguring DM devices requires CAP_SYS_ADMIN, but triggering the bug only requires the ability to issue I/O to an existing affected mapped device, for example through files the local user can read or write. Thus a basic unprivileged local user can reach the vulnerable path.\nUI:N - The attacker can trigger the I/O directly through their own syscalls. No separate victim action is required.\nS:U - The impact remains within the kernel/host security authority. This is a standard local kernel memory-corruption issue, not a VM escape or cross-authority boundary bypass.\nC:H - The stale cloned bio pointer causes use-after-free/double-free of kernel heap objects from the DM bioset. Per kernel CVSS guidance, such memory corruption is treated as capable of enabling high-impact information disclosure.\nI:H - The double-free/use-after-free can corrupt allocator state or allow overlapping/reused kernel objects, which is defensibly exploitable for arbitrary memory modification or code execution. Per guidance, UAF/double-free memory corruption warrants high integrity impact.\nA:H - Even without full exploitation, the double-free/use-after-free can trigger kernel memory corruption, oops, or panic during I/O completion. Repeated attacker-controlled I/O can repeatedly hit the vulnerable path."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:27:00.162Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.165"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.6.128"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.12.75"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.18.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.19.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-43278","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:16:11.058094Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-415","lang":"en","type":"CWE","description":"CWE-415 Double Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T19:16:25.598Z"}}]}}}