CyberSecBulletin
CVE-2026-46107NVD status: Modified

Linux: Integer Underflow (Wrap or Wraparound)

Published Updated By the CyberSecBulletin desk

CVE-2026-46107 is a high-severity integer underflow (wrap or wraparound) vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions b719d12cb94df345e9ad2715fd0abe9afcaeb111, f49b41c9eb7c6ff00df27cd49cea210abbadd8ad, f06f6aededd792a754cd677c02b3d3016d868c2c as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.1% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to b719d12cb94df345e9ad2715fd0abe9afcaeb111 or f49b41c9eb7c6ff00df27cd49cea210abbadd8ad or f06f6aededd792a754cd677c02b3d3016d868c2c or 12161e03d33afce781f68fa11cc6060538862fad, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.209 or 6.1.175 or 6.6.140, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 up to, but not including, b719d12cb94df345e9ad2715fd0abe9afcaeb111; 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 up to, but not including, f49b41c9eb7c6ff00df27cd49cea210abbadd8ad; 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 up to, but not including, f06f6aededd792a754cd677c02b3d3016d868c2c; 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 up to, but not including, 12161e03d33afce781f68fa11cc6060538862fad; 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 up to, but not including, 323d252a4a378834e4fe68298ca61cfc5dd3a460; 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 up to, but not including, 85311a585a26640760cd0f3349ab9f2905691044; 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 up to, but not including, 5ec0debbcfd43596e32c1239e993de06a704e04c; 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 up to, but not including, 09a65adc7d8bbfce06392cb6d375468e2728ead5; and 1 more rangesb719d12cb94df345e9ad2715fd0abe9afcaeb111, f49b41c9eb7c6ff00df27cd49cea210abbadd8ad, f06f6aededd792a754cd677c02b3d3016d868c2c, 12161e03d33afce781f68fa11cc6060538862fad, 323d252a4a378834e4fe68298ca61cfc5dd3a460, 85311a585a26640760cd0f3349ab9f2905691044
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel3.2 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.140; 6.7 up to, but not including, 6.12.88; 6.13 up to, but not including, 6.18.30; 6.19 up to, but not including, 7.0.7; 7.15.10.259, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

More Integer Underflow (Wrap or Wraparound) vulnerabilities (CWE-191)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Integer Underflow (Wrap or Wraparound) vulnerabilities

Spotted an error? Tell us.