CVE-2026-43278: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43278 Overview

CVE-2026-43278 is a Linux kernel vulnerability in the device-mapper (dm) subsystem. The flaw affects request-based device-mapper targets, where stale rq->bio values cause double-initialization of cloned bios. The condition leads to use-after-free and double-free scenarios during request completion. The issue manifests in production environments running dm-multipath on top of PCIe NVMe namespaces. Cloned request bios freed during blk_complete_request() are subsequently freed again via blk_rq_unprep_clone() during clone teardown. The upstream fix clears the clone request's bio pointer when the last cloned bio completes.

Critical Impact
Double-free and use-after-free conditions in the kernel block layer can lead to memory corruption, kernel panics, and potential local privilege escalation on systems using request-based device-mapper targets such as dm-multipath.

Affected Products

Linux kernel (mainline) — request-based device-mapper subsystem
Linux kernel stable trees referenced by commits 3d746b6, 7daf279, 83d7209, 8d9ddad, 9a95b98, b1c1a26, e2e738e, and fb8a6c1
Systems using dm-multipath over PCIe NVMe namespaces

Discovery Timeline

2026-05-06 - CVE-2026-43278 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43278

Vulnerability Analysis

The vulnerability resides in the request-based path of the Linux device-mapper subsystem. When a DM clone request completes, the block layer invokes bio_endio() on each cloned bio through blk_complete_request(). This first pass releases all clone bios. However, the request's rq->bio pointer is not cleared after this completion path. Later, the DM completion chain runs dm_complete_request() → dm_softirq_done() → dm_done() → dm_end_request(), which calls blk_rq_unprep_clone(). That teardown walks rq->bio and frees the same bios a second time. The result is a classic double-free, with the additional risk of use-after-free on any allocator reuse between the two free operations.

Root Cause

The root cause is missing state reset on the request structure. The block completion path frees cloned bios but leaves stale references in rq->bio. Without clearing the pointer when the last clone bio completes, subsequent code paths assume the bio chain is still valid and attempt to release it again. This is a memory management lifecycle bug in the interaction between the block multi-queue completion fast path and the device-mapper clone teardown logic.

Attack Vector

Triggering the condition requires I/O activity through a request-based DM target stacked on a block device whose driver completes requests in batches. The reproducer documented in the upstream patch uses dm-multipath over PCIe NVMe, where nvme_pci_complete_batch() drives blk_mq_end_request_batch() and exposes the stale rq->bio window. Exploitation primitives depend on heap layout and timing of the freed bio slab objects. A local attacker with the ability to issue I/O to an affected DM device may be able to influence allocator state and convert the double-free into kernel memory corruption.

The vulnerability is described in prose because no public proof-of-concept exploit code is available. See the Linux Kernel Commit 3d746b6 for the authoritative patch and call-path analysis.

Detection Methods for CVE-2026-43278

Indicators of Compromise

Kernel oops or panic traces referencing blk_rq_unprep_clone, bio_endio, dm_done, or end_clone_request on systems running dm-multipath.
KASAN reports flagging double-free or use-after-free in the bio slab cache during NVMe batch completion.
Unexpected SCSI or NVMe path failures correlated with sudden kernel log entries from the device-mapper subsystem.

Detection Strategies

Enable CONFIG_KASAN in non-production kernels to catch double-free and use-after-free conditions in the bio allocator at runtime.
Monitor dmesg and /var/log/kern.log for stack traces containing both blk_complete_request and blk_rq_unprep_clone frames.
Inventory kernel build versions across the fleet and compare against the fixed commit hashes referenced in the upstream advisory.

Monitoring Recommendations

Forward kernel logs from systems running dm-multipath over NVMe to a centralized logging platform and alert on BUG: or general protection fault patterns.
Track host stability metrics (kernel panics, unexpected reboots) on storage nodes and database servers that rely on multipath I/O.
Correlate I/O subsystem errors with workload spikes to surface latent triggering of the race window.

How to Mitigate CVE-2026-43278

Immediate Actions Required

Apply the upstream Linux kernel patch series that clears the cloned request bio pointer when the last clone bio completes.
Update to a stable kernel build that incorporates one of the referenced fix commits and reboot affected hosts.
Prioritize patching on systems using dm-multipath stacked on PCIe NVMe namespaces, where the issue has been reproduced.

Patch Information

The fix is available in the upstream Linux kernel and backported to multiple stable trees. Reference commits include Linux Kernel Commit 3d746b6, Linux Kernel Commit 7daf279, Linux Kernel Commit 83d7209, Linux Kernel Commit 8d9ddad, Linux Kernel Commit 9a95b98, Linux Kernel Commit b1c1a26, Linux Kernel Commit e2e738e, and Linux Kernel Commit fb8a6c1. Consult your distribution's security tracker for the matching package version.

Workarounds

Where patching is not immediately feasible, consider replacing request-based dm-multipath configurations with NVMe native multipathing (nvme_core.multipath=Y) on supported hardware.
Restrict local user access to systems exposing affected DM devices to reduce the attack surface for triggering I/O patterns that exercise the race.
Disable batched NVMe completion paths only as a last resort and after measuring performance impact in a non-production environment.

bash

# Verify running kernel version and check for the fix
uname -r

# Inspect device-mapper targets in use
dmsetup table

# Confirm whether dm-multipath is active over NVMe
multipath -ll
ls -l /sys/block/nvme*/holders/

# On distributions with vendor backports, update and reboot
sudo apt update && sudo apt upgrade linux-image-generic   # Debian/Ubuntu
sudo dnf update kernel                                    # RHEL/Fedora
sudo reboot