Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23356— drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于drbd_al_begin_io_nonblock中逻辑错误，可能导致竞争条件和内核崩溃。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.13% · P2

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 08a1ddab6df7d3c7b6341774cb1cf4b21b96a214< 933d161baa3794547adee621c0bf52cbf2c1b3cd affected
08a1ddab6df7d3c7b6341774cb1cf4b21b96a214< cf01aa6288e1190f89865e765056e2a9d8190639 affected
08a1ddab6df7d3c7b6341774cb1cf4b21b96a214< 7752569fc78e89794ce28946529850282233f99d affected
08a1ddab6df7d3c7b6341774cb1cf4b21b96a214< e91d8d6565b7819d13dab21d4dbed5b45efba59b affected
08a1ddab6df7d3c7b6341774cb1cf4b21b96a214< eef1390125b660b8b61f9f227a03bb9c5e6d36a5 affected
08a1ddab6df7d3c7b6341774cb1cf4b21b96a214< d1ef3aed4df2ef1fe46befd8f2da9a6ec5445508 affected
08a1ddab6df7d3c7b6341774cb1cf4b21b96a214< f558e5404a72054b525dced1a0c66aa95a144153 affected
08a1ddab6df7d3c7b6341774cb1cf4b21b96a214< ab140365fb62c0bdab22b2f516aff563b2559e3b affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23356

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Even though we check that we "should" be able to do lc_get_cumulative() while holding the device->al_lock spinlock, it may still fail, if some other code path decided to do lc_try_lock() with bad timing. If that happened, we logged "LOGIC BUG for enr=...", but still did not return an error. The rest of the code now assumed that this request has references for the relevant activity log extents. The implcations are that during an active resync, mutual exclusivity of resync versus application IO is not guaranteed. And a potential crash at this point may not realizs that these extents could have been target of in-flight IO and would need to be resynced just in case. Also, once the request completes, it will give up activity log references it does not even hold, which will trigger a BUG_ON(refcnt == 0) in lc_put(). Fix: Do not crash the kernel for a condition that is harmless during normal operation: also catch "e->refcnt == 0", not only "e == NULL" when being noisy about "al_complete_io() called on inactive extent %u\n". And do not try to be smart and "guess" whether something will work, then be surprised when it does not. Deal with the fact that it may or may not work. If it does not, remember a possible "partially in activity log" state (only possible for requests that cross extent boundaries), and return an error code from drbd_al_begin_io_nonblock(). A latter call for the same request will then resume from where we left off.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于drbd_al_begin_io_nonblock中逻辑错误，可能导致竞争条件和内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 08a1ddab6df7d3c7b6341774cb1cf4b21b96a214 ~ 933d161baa3794547adee621c0bf52cbf2c1b3cd -
Linux Linux 3.10 -

II. Public POCs for CVE-2026-23356

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23356

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-23356 (6)

Same Patch Batch · Linux · 2026-03-25 · 116 CVEs total

CVE-2026-23395 8.8 HIGH Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
CVE-2026-31788 8.2 HIGH xen/privcmd: restrict usage in unprivileged domU
CVE-2026-23340 7.8 HIGH net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
CVE-2026-23336 7.8 HIGH wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
CVE-2026-23350 7.8 HIGH drm/xe/queue: Call fini on exec queue creation fail
CVE-2026-23351 7.8 HIGH netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
CVE-2026-23317 7.8 HIGH drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
CVE-2026-23306 7.8 HIGH scsi: pm8001: Fix use-after-free in pm8001_queue_command()
CVE-2026-23372 7.8 HIGH nfc: rawsock: cancel tx_work before socket teardown
CVE-2026-23378 7.8 HIGH net/sched: act_ife: Fix metalist update behavior
CVE-2026-23383 7.8 HIGH bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
CVE-2026-23391 7.8 HIGH netfilter: xt_CT: drop pending enqueued packets on template removal
CVE-2026-23392 7.8 HIGH netfilter: nf_tables: release flowtable after rcu grace period on error
CVE-2026-23393 7.8 HIGH bridge: cfm: Fix race condition in peer_mep deletion
CVE-2026-23280 7.8 HIGH accel/amdxdna: Prevent ubuf size overflow
CVE-2026-23288 7.8 HIGH accel/amdxdna: Fix out-of-bounds memset in command slot handling
CVE-2026-23364 7.4 HIGH ksmbd: Compare MACs in constant time
CVE-2026-23294 7.0 HIGH bpf: Fix race in devmap on PREEMPT_RT
CVE-2026-23354 x86/fred: Correct speculative safety in fred_extint()
CVE-2026-23355 ata: libata: cancel pending work after clearing deferred_qc

Showing top 20 of 116 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23356

No comments yet

Leave a comment