CVE-2026-46107

Description

In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There-s a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node-s child to the node itself and then decrement the child-s reference count. If the child node is shared (it has reference count > 1), we won-t free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn-t match the number of pointers that point to the grandchildren. This results in -device mapper: space map common: unable to decrement block- errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared.