CVE-2026-23356: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23356 is a resource locking flaw in the Linux kernel's DRBD (Distributed Replicated Block Device) subsystem, specifically in the drbd_al_begin_io_nonblock() function. The vulnerability was disclosed on March 25, 2026, and affects Linux kernel versions from 3.10.1 through multiple stable branches, including versions before 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, and 6.19.7, as well as 7.0 release candidates (Red Hat Bugzilla, Feedly). It carries a CVSS v3.1 base score of 5.5 (Medium), with local access required and high availability impact (Feedly).

The root cause is classified under CWE-413 (Improper Resource Locking) and CWE-617 (Reachable Assertion). In drbd_al_begin_io_nonblock(), the code checks whether lc_get_cumulative() should succeed while holding the device->al_lock spinlock, but a concurrent lc_try_lock() call with unfortunate timing can cause it to fail. When this occurs, the code logs a "LOGIC BUG for enr=..." message but does not return an error, incorrectly assuming the request holds valid activity log extent references. When the request later completes, it attempts to release references it never acquired, triggering a BUG_ON(refcnt == 0) assertion in lc_put(). The fix involves properly handling the failure case, tracking a "partially in activity log" state for cross-boundary requests, and returning an appropriate error code (Red Hat Bugzilla).

Exploitation of this vulnerability primarily affects availability. During active DRBD resync operations, the mutual exclusivity between resync and application I/O is not guaranteed, potentially causing data consistency issues on replicated block devices. In the worst case, the kernel panics via a BUG_ON assertion in lc_put() when a request releases activity log references it does not hold; additionally, a crash may fail to recognize that in-flight I/O targets require resyncing, risking data integrity on DRBD-backed storage (Red Hat Bugzilla, Feedly). There is no confidentiality or integrity impact beyond the DRBD subsystem scope.

• Logs: Kernel log messages containing "LOGIC BUG for enr=" from the DRBD subsystem, indicating the race condition was triggered.
• Logs: Kernel panic or BUG_ON assertion messages referencing lc_put() with refcnt == 0, indicating the request attempted to release unacquired activity log references.
• Logs: Messages such as "al_complete_io() called on inactive extent" in kernel logs, which the fix also addresses.
• Process/System: Unexpected kernel panics or system reboots on systems actively using DRBD for storage replication, particularly during resync operations.

Update the Linux kernel to a patched version: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.77+, 6.18.17+, or 6.19.7+, depending on the branch in use (Feedly). Patches are available via the upstream stable kernel tree at git.kernel.org across multiple stable branches. Distribution-specific updates are available for Amazon Linux 2023, Debian (DSA-6243-1, DLA-4561-1), and Microsoft Azure Linux (azl3_kernel_6.6.126.1-1 and later). As a temporary workaround, systems not actively using DRBD for storage replication are not exposed to this code path and face reduced risk.