CVE-2026-46079 Overview
CVE-2026-46079 is a null pointer dereference vulnerability in the Linux kernel's Rados Block Device (RBD) driver. The flaw resides in the do_rbd_add() function, which publishes the device via device_add() before calling device_add_disk(). When device_add_disk() fails after device_add() succeeds, the error path calls rbd_free_disk() directly and then falls through to rbd_dev_device_release(), which calls rbd_free_disk() again. This double teardown causes blk-mq cleanup to operate on invalid state, triggering a null pointer dereference in __blk_mq_free_map_and_rqs() reached from blk_mq_free_tag_set().
Critical Impact
A local attacker capable of mapping RBD images through /sys/bus/rbd/add_single_major can trigger kernel memory corruption and denial of service via the double-free teardown path.
Affected Products
- Linux kernel mainline (issue reproduced on v7.0)
- Linux kernel v6.13-rc1 (initial flagging)
- Systems using the RBD (Ceph Rados Block Device) driver
Discovery Timeline
- 2026-05-27 - CVE-2026-46079 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46079
Vulnerability Analysis
The vulnerability is a null pointer dereference [CWE-476] in the Linux kernel RBD block driver. The bug manifests during the error-handling path of do_rbd_add() when mapping a Ceph RBD image fails partway through device registration. The reproducer confines failslab injections to the __add_disk() range using fail-nth while mapping an RBD image. On unpatched kernels, fail-nth=4 reliably triggers a general protection fault in __blk_mq_free_map_and_rqs() with KASAN reporting a null pointer dereference in the range [0x0000000000000000-0x0000000000000007].
Root Cause
The ordering in do_rbd_add() publishes the device with device_add() before invoking device_add_disk(). When device_add_disk() fails, the error path directly invokes rbd_free_disk() and then falls through to rbd_dev_device_release(), which calls rbd_free_disk() again. The second invocation operates on already-released blk-mq tag set state, leading to dereference of a null map pointer inside __blk_mq_free_map_and_rqs(), reached from blk_mq_free_tag_set().
Attack Vector
Triggering the bug requires local privileged access to write to /sys/bus/rbd/add_single_major and the ability to induce allocation failures during __add_disk(). The bug was reproduced inside a QEMU x86_64 guest with KASAN and CONFIG_FAILSLAB enabled, using fault injection to simulate the allocation failure. No verified public exploit code is available; refer to the upstream kernel commits for the patch details.
Detection Methods for CVE-2026-46079
Indicators of Compromise
- Kernel oops or general protection fault messages referencing __blk_mq_free_map_and_rqs+0x8c/0x240 in dmesg or journal logs.
- KASAN reports of null-ptr-deref in range [0x0000000000000000-0x0000000000000007] originating from blk_mq_free_tag_set in the do_rbd_add call stack.
- Unexpected crashes or panics on hosts performing RBD image map operations via /sys/bus/rbd/add_single_major.
Detection Strategies
- Monitor kernel logs for crash signatures involving do_rbd_add and blk_mq_free_tag_set to identify exploitation attempts or unstable hosts.
- Audit running kernel versions against the upstream stable commits to identify hosts missing the fix.
- Track writes to /sys/bus/rbd/add_single_major and /sys/bus/rbd/add by non-administrative processes through auditd rules.
Monitoring Recommendations
- Enable persistent kernel crash dump collection (kdump) on Ceph client hosts to capture oops traces if the bug is triggered.
- Aggregate kernel ring buffer logs centrally and alert on BUG:, KASAN:, or general protection fault substrings.
- Inventory hosts running the RBD driver and validate kernel patch level against the referenced stable trees.
How to Mitigate CVE-2026-46079
Immediate Actions Required
- Apply the upstream Linux kernel patches that reorder the error path in do_rbd_add() to call device_del() before rbd_dev_device_release() when device_add_disk() fails.
- Update kernels to the stable release containing the fix referenced in the upstream commits.
- Restrict access to /sys/bus/rbd/add and /sys/bus/rbd/add_single_major to trusted administrative accounts only.
Patch Information
The fix is available across multiple stable trees through the following upstream commits: Kernel Git Commit 059fb76, Kernel Git Commit 2f4809a8, Kernel Git Commit 564cd8f4, Kernel Git Commit ad0126ff, and Kernel Git Commit d1fef92e. The fix follows the normal remove ordering by calling device_del() before rbd_dev_device_release() to keep the teardown sequence consistent.
Workarounds
- Avoid loading the rbd kernel module on hosts that do not require Ceph RBD client functionality.
- Limit local user access on Ceph client systems and require root privileges for RBD mapping operations.
- Disable fault-injection facilities such as CONFIG_FAILSLAB in production builds where they are not required for testing.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
