Security readout for executives and security teams
Plain-English summary
A Linux kernel device-mapper cleanup bug can double-free memory after a request-based mapped device table fails to load. The observed failure path can end in a kernel oops and panic, creating availability risk on affected systems. The source bundle does not show active exploitation or a CVSS score.
Executive priority
Patch during normal high-priority kernel maintenance, escalating for storage-heavy or multipath-dependent systems. There is credible crash impact, but the provided evidence does not support emergency treatment for internet-facing exploitation.
Technical view
The bug is in request-based device-mapper queue setup. If blk_mq_tag_set allocation or initialization fails, the pointer was freed but not cleared. Later device removal could treat the stale pointer as valid and free it again. Kernel stable commits clear the pointer in error handling and cleanup paths.
Likely exposure
Exposure is most likely on Linux systems using request-based device-mapper configurations, such as multipath-related environments, with affected kernel versions before the relevant stable fixes. Systems not using this path are less likely exposed, but kernel provenance should be verified.
Exploitation context
The source describes a crash sequence from a table-load failure followed by device removal. CISA KEV status is false in the bundle, and no provided source claims in-the-wild exploitation. Treat this primarily as a stability and denial-of-service concern unless vendor advisories say otherwise.
Researcher notes
The vulnerable condition is an error path after dm_mq_init_request_queue failure, followed by dev_remove cleanup. The fix clears md->tag_set after failed initialization and during dm_mq_cleanup_mapped_device. Evidence is incomplete on attacker prerequisites, reachability, and distribution-specific exposure.
Mitigation direction
- Update affected Linux kernels to vendor builds containing the referenced stable fixes.
- Prioritize hosts using device-mapper, multipath, or request-based mapped devices.
- Check Linux distribution advisories for exact fixed package versions.
- Avoid direct wrangler or deployment assumptions; use standard OS patch channels.
- Plan maintenance for storage infrastructure where kernel restarts may be required.
Validation and detection
- Inventory kernel versions across Linux hosts and appliances.
- Identify systems using device-mapper or multipath services.
- Compare running kernels with vendor advisories and referenced stable commits.
- Review kernel logs for device-mapper queue initialization failures or oops traces.
- Confirm patched hosts rebooted into the fixed kernel.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 8ae0185255eaf05bd66f4215c81e99bf01140fd9
- Linux stable commit b42c0a33dfdd451d9be62dd5de58c39f2750b6e3
- Linux stable commit 772b9f59657665af3b68d24d12b9d172d31f0dfb
- Linux stable commit a992a283c0b77d0a7c2c348add0e6a21fb1dab67
- Linux stable commit 1cb02dc76f4c0a2749a02b26469512d6984252e9
- Linux stable commit 6086f957416a6e87236c06079fcaba7a3998aeca
- Linux stable commit d757bf4c69cda3c3ab7f775dfabbf5a80e2f6f9d
- Linux stable commit 8e947c8f4a5620df77e43c9c75310dc510250166
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-46938 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8ae0185255eaf05bd66f4215c81e99bf01140fd9CVE reference, Linux
- https://git.kernel.org/stable/c/b42c0a33dfdd451d9be62dd5de58c39f2750b6e3CVE reference, Linux
- https://git.kernel.org/stable/c/772b9f59657665af3b68d24d12b9d172d31f0dfbCVE reference, Linux
- https://git.kernel.org/stable/c/a992a283c0b77d0a7c2c348add0e6a21fb1dab67CVE reference, Linux
- https://git.kernel.org/stable/c/1cb02dc76f4c0a2749a02b26469512d6984252e9CVE reference, Linux
- https://git.kernel.org/stable/c/6086f957416a6e87236c06079fcaba7a3998aecaCVE reference, Linux
- https://git.kernel.org/stable/c/d757bf4c69cda3c3ab7f775dfabbf5a80e2f6f9dCVE reference, Linux
- https://git.kernel.org/stable/c/8e947c8f4a5620df77e43c9c75310dc510250166CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.