CVE-2026-46327

A flaw was found in the Linux kernel's device mapper (dm) component. The dm_blk_report_zones function performs a check for the device's suspended state without proper locking. This allows the device to enter a suspended state immediately after the check, leading to an inconsistent state. This inconsistency could potentially result in unexpected system behavior or a denial of service (DoS) condition.

This vulnerability is rated as having a Low severity because exploiting the race condition requires local system access and specific operations against zoned block devices under Device Mapper, limiting the practical blast radius to a denial of service. The issue manifests only when querying zone details during concurrent device suspension operations, which typically requires administrative privileges to initiate. Consequently, unprivileged users on standard enterprise configurations cannot readily trigger the condition, and normal workloads on conventional non-zoned storage remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.