CVE-2026-43192 Overview
CVE-2026-43192 is a resource management vulnerability in the Linux kernel's device-mapper multipath (dm mpath) subsystem. The flaw exists in the parse_path() function, which fails to release a device reference when scsi_dh_attached_handler_name() returns an -ENOMEM error. The missing dm_put_device() call results in a reference leak on the path device. The issue was introduced by commit fd81bc5cca8f ("scsi: device_handler: Return error pointer in scsi_dh_attached_handler_name()"), which added the new error path without corresponding cleanup logic.
Critical Impact
A reference count leak in dm mpath path parsing can prevent proper teardown of block devices and contribute to kernel resource exhaustion under repeated failure conditions.
Affected Products
- Linux kernel versions containing commit fd81bc5cca8f prior to the fix
- Systems using device-mapper multipath (dm mpath) with SCSI device handlers
- Distributions shipping affected stable kernel branches
Discovery Timeline
- 2026-05-06 - CVE-2026-43192 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43192
Vulnerability Analysis
The vulnerability resides in the parse_path() function within the device-mapper multipath target. During path configuration, the kernel calls dm_get_device() to obtain a reference to the underlying block device. It then invokes scsi_dh_attached_handler_name() to query the attached SCSI device handler name.
A prior change, commit fd81bc5cca8f, modified scsi_dh_attached_handler_name() to return an error pointer rather than NULL on memory allocation failures. The patch added a new failure branch in parse_path() to handle the -ENOMEM return code. However, that branch returns directly without calling dm_put_device(), leaving the device reference acquired earlier in the function uncleaned.
The defect is classified as a Memory Leak [CWE-401] combined with improper resource cleanup on an error path. Repeated invocation under low-memory conditions amplifies the leak and can hold device references long after the multipath table parsing has failed.
Root Cause
The root cause is incomplete error-handling refactoring. When the new -ENOMEM failure mode was introduced into parse_path(), the cleanup sequence calling dm_put_device() was omitted. The fix streamlines the error paths of parse_path() so all failure branches release the device reference consistently.
Attack Vector
This is a local, low-privilege resource management defect rather than a remotely exploitable code execution flaw. Triggering the leak requires the ability to configure or reload device-mapper multipath tables, typically a privileged operation. Under sustained memory pressure, repeated path parsing failures could accumulate stale device references and disrupt storage device lifecycle management.
The vulnerability manifests in the parse_path() cleanup logic. See the upstream commits referenced in the NVD entry for the precise diff: Linux Kernel Commit 4aa5c37b7d80 and Linux Kernel Commit 787bd63ee661.
Detection Methods for CVE-2026-43192
Indicators of Compromise
- Unexpected references held on block devices that cannot be removed via dmsetup remove or multipath -f
- Kernel log entries showing repeated scsi_dh_attached_handler_name()-ENOMEM failures
- Growing slab allocations associated with device-mapper structures under memory pressure
Detection Strategies
- Audit running kernel versions across the fleet and compare against the patched stable releases referenced in the NVD entry.
- Monitor dmesg and journal logs for multipath path-parsing failures correlated with low-memory events.
- Inspect /sys/block/<dev>/holders and device-mapper state for orphaned references after failed multipath reconfiguration.
Monitoring Recommendations
- Track kernel slab usage and device-mapper object counts via slabtop and /proc/slabinfo.
- Alert on repeated multipath table-load failures returning -ENOMEM from storage management tooling.
- Centralize kernel logs to identify hosts experiencing recurring dm mpath parse errors.
How to Mitigate CVE-2026-43192
Immediate Actions Required
- Identify hosts running Linux kernel versions that include commit fd81bc5cca8f but lack the fix commits.
- Apply the upstream stable kernel update containing commits 4aa5c37b7d80 and 787bd63ee661.
- Reboot affected systems after updating to ensure the patched kernel is active.
Patch Information
The issue is resolved upstream in the Linux kernel stable tree. The fix adds the missing dm_put_device() call on the -ENOMEM failure path and streamlines the error handling in parse_path(). Refer to Linux Kernel Commit 4aa5c37b7d80 and Linux Kernel Commit 787bd63ee661 for the patch content. Distribution-specific updates should be tracked through vendor security advisories.
Workarounds
- No direct configuration workaround removes the leak; patching the kernel is the supported remediation.
- Reduce exposure by avoiding repeated multipath table reloads on memory-constrained hosts until the patch is deployed.
- Restrict privileged access required to configure device-mapper multipath to limit the ability to trigger the failing code path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
