CVE-2017-18203: Race Condition
Last updated 4 July 2026
Other sources
The dmgetfromkobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with dmdestroy during creation and removal of DM devices.
— Launchpad
The Linux kernel before version 4.14.3 is vulnerable to a denial of service in drivers/md/dm.c:dmgetfromkobject() which can be caused by local users leveraging a race condition with dmdestroy() during creation and removal of DM devices. Only privileged local users (with CAPSYSADMIN capability) can directly perform the ioctl operations for dm device creation and removal and this would typically be outside the direct control of the unprivileged attacker.
References:
https://patchwork.kernel.org/patch/10035971/
https://marc.info/?l=dm-devel&m=150952182422209&w=2
An upstream commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b9a41d21dceadf8104812626ef85dc56ee8a60ed
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.14.3 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 4.14.3 - Compensating control
Mitigate by restricting who can create/remove device-mapper (dm) devices so only privileged local users with CAP_SYS_ADMIN can perform the dm device creation and removal ioctl operations.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-18203?
CVE-2017-18203 has been classified as a high-severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2017-18203?
To fix CVE-2017-18203, update the Linux kernel to version 4.14.3 or later.
Which versions of the Linux kernel are affected by CVE-2017-18203?
CVE-2017-18203 affects Linux kernel versions prior to 4.14.3.
Is there a patch available for CVE-2017-18203?
Yes, a patch is available in Linux kernel version 4.14.3 and subsequent releases.
What impact does CVE-2017-18203 have on system security?
CVE-2017-18203 can lead to denial of service, compromising system availability.