Linux · Linux Kernel · CVE-2026-46079
**Name of the Vulnerable Software and Affected Versions**
Linux kernel versions prior to 7.0.11-1.1
**Description**
A null-pointer dereference occurs in the `rbd` module when `device add disk()` fails after `device add()` has successfully published the device. In this scenario, the error path triggers a double teardown by calling `rbd free disk()` twice: once directly and again via `rbd dev device release()`. This inconsistent sequence leaves the blk-mq cleanup in an invalid state, leading to a crash in the ` blk mq free map and rqs()` function, which is reached through `blk mq free tag set()`. The issue can be triggered when mapping an RBD image through the `/sys/bus/rbd/add single major` endpoint.
**Recommendations**
Update the Linux kernel to version 7.0.11-1.1 or later.