CVE-2026-72108
dm thin metadata: fix metadata snapshot consistency on commit failure
Description
In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure __reserve_metadata_snap() and __release_metadata_snap() modify the superblock's held_root directly in the block_manager's buffer. If the subsequent metadata commit fails, the held_root gets flushed to disk through the abort_transaction path, resulting in inconsistent metadata. Reproducer 1: __reserve_metadata_snap() 1. Create a 2 MiB metadata device and make the region after the 14th block inaccessible, to trigger metadata commit failure in the subsequent reserve_metadata_snap operation. The 14th block will be the shadow destination for the index block. dmsetup create tmeta --table "0 112 linear /dev/sdc 0 112 3984 error" 2. Create a 16 MiB thin-pool dmsetup create tdata --table "0 32768 zero" dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1 dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \ /dev/mapper/tdata 128 0 1 skip_block_zeroing" 3. Take a metadata snapshot to trigger metadata commit failure and transaction abort. However, the held_root is written to disk, breaking metadata consistency. dmsetup message tpool 0 "reserve_metadata_snap" thin_check v1.2.2 result: Bad reference count for metadata block 6. Expected 2, but space map contains 1. Bad reference count for metadata block 7. Expected 2, but space map contains 1. Bad reference count for metadata block 13. Expected 1, but space map contains 0. Reproducer 2: __release_metadata_snap() 1. Create a 2 MiB metadata device and make the region after the 16th block inaccessible, to trigger metadata commit failure in the subsequent release_metadata_snap operation. The 16th block will be the shadow destination for the index block. dmsetup create tmeta --table "0 128 linear /dev/sdc 0 128 3968 error" 2. Create a 16 MiB thin-pool dmsetup create tdata --table "0 32768 zero" dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1 dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \ /dev/mapper/tdata 128 0 1 skip_block_zeroing" 3. Reserve then release the metadata snapshot, to trigger metadata commit failure and transaction abort. The held_root gets removed from the on-disk superblock, causing inconsistent metadata. dmsetup message tpool 0 "reserve_metadata_snap" dmsetup message tpool 0 "release_metadata_snap" thin_check v1.2.2 result: Bad reference count for metadata block 6. Expected 1, but space map contains 2. Bad reference count for metadata block 7. Expected 1, but space map contains 2. 1 metadata blocks have leaked. Fix by deferring the held_root update to commit time. Additionally, move the existing-snapshot check in __reserve_metadata_snap before the shadow operation to avoid unnecessary work. In __release_metadata_snap, clear pmd->held_root before btree deletion so partial failure leaks blocks rather than leaving a stale reference, and unlock the snapshot block before decrementing its refcount.
INFO
Published Date :
Aug. 15, 2026, 6:21 a.m.
Last Modified :
Aug. 17, 2026, 6:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Apply the Linux kernel patch.
- Update dm thin metadata.
- Defer held_root update to commit time.
- Clear snapshot references before deletion.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72108.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72108 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72108
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72108 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72108 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '4af993468193cf4cd32ba5748786e7801945f7d2', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': 'abf2fae92cbe68945028987d498cc72f8f0e23a8', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '5efb1a7734ed4035fa4fdc3716bdb84621f27cf6', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '3dc9ae1029320d77472c44965e572f176949cd63', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': 'b5f9a31c51cbb374a1713c3494f8660ab070f035', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '7f76245960a332f39b08cc556e675d1765dc5bbb', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '9f1a0d27586ceab055e6b050e3731ce3c6b2c4f0', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '5bcd4d3058ebaf46ad2e163829d87dd4870c7a45', 'versionType': 'git'}], 'programFiles': ['drivers/md/dm-thin-metadata.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/md/dm-thin-metadata.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '4af993468193cf4cd32ba5748786e7801945f7d2', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': 'abf2fae92cbe68945028987d498cc72f8f0e23a8', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '5efb1a7734ed4035fa4fdc3716bdb84621f27cf6', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '3dc9ae1029320d77472c44965e572f176949cd63', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': 'b5f9a31c51cbb374a1713c3494f8660ab070f035', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '7f76245960a332f39b08cc556e675d1765dc5bbb', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '9f1a0d27586ceab055e6b050e3731ce3c6b2c4f0', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '5bcd4d3058ebaf46ad2e163829d87dd4870c7a45', 'versionType': 'git'}], 'programFiles': ['drivers/md/dm-thin-metadata.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/md/dm-thin-metadata.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '4af993468193cf4cd32ba5748786e7801945f7d2', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': 'abf2fae92cbe68945028987d498cc72f8f0e23a8', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '5efb1a7734ed4035fa4fdc3716bdb84621f27cf6', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '3dc9ae1029320d77472c44965e572f176949cd63', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': 'b5f9a31c51cbb374a1713c3494f8660ab070f035', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '7f76245960a332f39b08cc556e675d1765dc5bbb', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '9f1a0d27586ceab055e6b050e3731ce3c6b2c4f0', 'versionType': 'git'}, {'status': 'affected', 'version': '991d9fa02da0dd1f843dc011376965e0c8c6c9b5', 'lessThan': '5bcd4d3058ebaf46ad2e163829d87dd4870c7a45', 'versionType': 'git'}], 'programFiles': ['drivers/md/dm-thin-metadata.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/md/dm-thin-metadata.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure __reserve_metadata_snap() and __release_metadata_snap() modify the superblock's held_root directly in the block_manager's buffer. If the subsequent metadata commit fails, the held_root gets flushed to disk through the abort_transaction path, resulting in inconsistent metadata. Reproducer 1: __reserve_metadata_snap() 1. Create a 2 MiB metadata device and make the region after the 14th block inaccessible, to trigger metadata commit failure in the subsequent reserve_metadata_snap operation. The 14th block will be the shadow destination for the index block. dmsetup create tmeta --table "0 112 linear /dev/sdc 0 112 3984 error" 2. Create a 16 MiB thin-pool dmsetup create tdata --table "0 32768 zero" dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1 dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \ /dev/mapper/tdata 128 0 1 skip_block_zeroing" 3. Take a metadata snapshot to trigger metadata commit failure and transaction abort. However, the held_root is written to disk, breaking metadata consistency. dmsetup message tpool 0 "reserve_metadata_snap" thin_check v1.2.2 result: Bad reference count for metadata block 6. Expected 2, but space map contains 1. Bad reference count for metadata block 7. Expected 2, but space map contains 1. Bad reference count for metadata block 13. Expected 1, but space map contains 0. Reproducer 2: __release_metadata_snap() 1. Create a 2 MiB metadata device and make the region after the 16th block inaccessible, to trigger metadata commit failure in the subsequent release_metadata_snap operation. The 16th block will be the shadow destination for the index block. dmsetup create tmeta --table "0 128 linear /dev/sdc 0 128 3968 error" 2. Create a 16 MiB thin-pool dmsetup create tdata --table "0 32768 zero" dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1 dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \ /dev/mapper/tdata 128 0 1 skip_block_zeroing" 3. Reserve then release the metadata snapshot, to trigger metadata commit failure and transaction abort. The held_root gets removed from the on-disk superblock, causing inconsistent metadata. dmsetup message tpool 0 "reserve_metadata_snap" dmsetup message tpool 0 "release_metadata_snap" thin_check v1.2.2 result: Bad reference count for metadata block 6. Expected 1, but space map contains 2. Bad reference count for metadata block 7. Expected 1, but space map contains 2. 1 metadata blocks have leaked. Fix by deferring the held_root update to commit time. Additionally, move the existing-snapshot check in __reserve_metadata_snap before the shadow operation to avoid unnecessary work. In __release_metadata_snap, clear pmd->held_root before btree deletion so partial failure leaks blocks rather than leaving a stale reference, and unlock the snapshot block before decrementing its refcount. Added Reference https://git.kernel.org/stable/c/3dc9ae1029320d77472c44965e572f176949cd63 Added Reference https://git.kernel.org/stable/c/4af993468193cf4cd32ba5748786e7801945f7d2 Added Reference https://git.kernel.org/stable/c/5bcd4d3058ebaf46ad2e163829d87dd4870c7a45 Added Reference https://git.kernel.org/stable/c/5efb1a7734ed4035fa4fdc3716bdb84621f27cf6 Added Reference https://git.kernel.org/stable/c/7f76245960a332f39b08cc556e675d1765dc5bbb Added Reference https://git.kernel.org/stable/c/9f1a0d27586ceab055e6b050e3731ce3c6b2c4f0 Added Reference https://git.kernel.org/stable/c/abf2fae92cbe68945028987d498cc72f8f0e23a8 Added Reference https://git.kernel.org/stable/c/b5f9a31c51cbb374a1713c3494f8660ab070f035