CVE-2026-43314: Linux Kernel DOS Vulnerability

CVE-2026-43314 Overview

CVE-2026-43314 is a request leak vulnerability in the Linux kernel device mapper (dm) subsystem. The flaw stems from dm calling blk_should_fake_timeout() despite having no native timeout handler. When a fake I/O timeout is injected on a dm device backed by a slave device such as iSCSI, the request is never completed and leaks. Tasks waiting on the queue hang indefinitely, producing kernel hung_task warnings and blocking queue teardown operations like del_gendisk. The issue is classified under [CWE-772] (Missing Release of Resource after Effective Lifetime).

Critical Impact
A local user with permission to toggle io-timeout-fail and fault-injection debugfs entries can leak block-layer requests on dm devices, causing indefinite task hangs and denial of service.

Affected Products

Linux Kernel (multiple stable branches, fixed across eight upstream commits)
Distributions shipping affected kernels with device-mapper enabled
Systems using dm over iSCSI or similar slave block devices

Discovery Timeline

2026-05-08 - CVE-2026-43314 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43314

Vulnerability Analysis

The device mapper driver relies on the timeout handling of its underlying slave devices and does not register its own blk_mq_ops.timeout callback. Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of blk_mq_complete_request"), individual drivers became responsible for invoking blk_should_fake_timeout() at appropriate completion paths. The dm driver inherited this call without owning a corresponding timeout handler, breaking the contract that fake timeouts require a driver-side recovery path.

When blk_should_fake_timeout() returns true for a dm request, completion is skipped. The slave device, such as iSCSI, has already finished its own I/O and will not re-issue the timeout for the dm layer. The request remains in flight forever. Subsequent operations that wait for the queue to drain, including blk_mq_freeze_queue_wait() invoked from elevator_change() and __del_gendisk(), block indefinitely. The kernel logs INFO: task ... blocked for more than 122 seconds and surfaces a stack trace through __iscsi_unbind_session and sd_remove.

Root Cause

The root cause is an architectural mismatch. The dm driver invoked the fake-timeout helper while lacking the native timeout handler required to recover from injected timeouts. Resources allocated for the request are never released, matching the [CWE-772] resource leak pattern.

Attack Vector

Exploitation requires local access with privileges to write to /sys/class/block/dm-*/io-timeout-fail and the fail_io_timeout debugfs knobs under /sys/kernel/debug/. An attacker enables fault injection, issues I/O against the dm device, then disconnects or unbinds the slave device. The leaked request stalls queue teardown and any process touching the affected block layer state, producing a denial-of-service condition on the host.

No verified public proof-of-concept exploit is available. The vulnerability description includes the reproducer steps from the upstream commit message; refer to the Linux stable tree commits for technical details.

Detection Methods for CVE-2026-43314

Indicators of Compromise

Kernel log entries containing INFO: task ... blocked for more than 122 seconds involving blk_mq_freeze_queue_wait in the call stack.
Hung worker threads such as kworker/u* stuck in __iscsi_unbind_session or __del_gendisk against dm-* devices.
Non-zero values in /sys/class/block/dm-*/io-timeout-fail combined with active fail_io_timeout probability settings on production hosts.

Detection Strategies

Monitor dmesg and /var/log/messages for hung_task_timeout_secs warnings referencing device-mapper or block multiqueue freeze paths.
Audit access to debugfs fault-injection paths under /sys/kernel/debug/fail_io_timeout/ and to io-timeout-fail sysfs attributes.
Track kernel versions against the fixed commits listed in the upstream stable advisories to identify unpatched hosts.

Monitoring Recommendations

Alert on task ... blocked kernel messages tied to blk_mq_freeze_queue_wait, elevator_change, or del_gendisk symbols.
Watch for unexpected writes to /sys/class/block/*/io-timeout-fail from non-administrative contexts using kernel audit rules.
Correlate iSCSI session teardown events with stuck dm I/O to surface in-progress request leaks before they cascade to dependent workloads.

How to Mitigate CVE-2026-43314

Immediate Actions Required

Apply the upstream fix that removes the blk_should_fake_timeout() call from the dm driver across all affected stable branches.
Restrict access to debugfs and io-timeout-fail sysfs entries by tightening permissions and limiting which users may mount or write to /sys/kernel/debug.
Inventory hosts using device-mapper over iSCSI, multipath, or LVM and prioritize them for patching given the queue-teardown impact.

Patch Information

The fix removes the fake-timeout check from the device mapper driver. Stable kernel commits are available at kernel.org commit cf2d06c9, commit 4f9e7ca9, commit 6cdb21e0, commit 8200fca8, commit b307b630, commit c8a23d4c, commit ece6720d, and commit f3a9c95a. Rebuild the kernel from a patched stable branch or install vendor-released errata kernels.

Workarounds

Disable kernel fault injection in production by ensuring CONFIG_FAIL_IO_TIMEOUT is not enabled or by unmounting debugfs on non-debug systems.
Set /sys/class/block/dm-*/io-timeout-fail to 0 and confirm fail_io_timeout/probability is 0 on all hosts running affected kernels.
Restrict CAP_SYS_ADMIN and root-equivalent privileges so unprivileged users cannot toggle fault-injection knobs against dm devices.

bash

# Disable fault injection knobs and verify state
echo 0 | sudo tee /sys/class/block/dm-0/io-timeout-fail
echo 0 | sudo tee /sys/kernel/debug/fail_io_timeout/probability
echo 0 | sudo tee /sys/kernel/debug/fail_io_timeout/times
sudo umount /sys/kernel/debug   # on hosts that do not require debugfs