PT-2026-27721 · Drbd+1 · Drbd+1

Published 2026-01-01 · Updated 2026-04-20 · CVE-2026-23356

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A logic error exists in the drbd al begin io nonblock() function within the Linux kernel’s DRBD module. The issue arises from a potential failure in lc get cumulative() while holding the device->al lock spinlock, due to timing issues with lc try lock(). This can lead to a situation where the system incorrectly assumes request references for activity log extents. The implications include a lack of guaranteed mutual exclusivity between resync operations and application I/O, potentially causing a kernel crash. Additionally, the code may release activity log references it does not hold, triggering a bug check in lc put(). The fix involves handling the possibility of lc get cumulative() failing and returning an error code from drbd al begin io nonblock(), allowing subsequent calls to resume from the point of interruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-23356

ECHO-6694-7A75-D9B2

Affected Products

Drbd

Linux Kernel

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23356.json · Exploit
• https://git.kernel.org/stable/c/933d161baa3794547adee621c0bf52cbf2c1b3cd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23356 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-23356 · Security Note
• https://git.kernel.org/stable/c/7752569fc78e89794ce28946529850282233f99d · Patch
• https://osv.dev/vulnerability/CVE-2026-23356 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23356 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23356 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-23356 · Vendor Advisory
• https://git.kernel.org/stable/c/e91d8d6565b7819d13dab21d4dbed5b45efba59b · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23356 · Vendor Advisory
• https://git.kernel.org/stable/c/ab140365fb62c0bdab22b2f516aff563b2559e3b · Patch
• https://git.kernel.org/stable/c/cf01aa6288e1190f89865e765056e2a9d8190639 · Patch
• https://git.kernel.org/stable/c/f558e5404a72054b525dced1a0c66aa95a144153 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-23356 · Vendor Advisory