The Linux kernel's device mapper thin provisioning metadata subsystem had a vulnerability where __reserve_metadata_snap() and __release_metadata_snap() functions modified the superblock's held_root directly in the block_manager's buffer. If a subsequent metadata commit failed, the held_root was flushed to disk via the abort_transaction path, causing inconsistent metadata snapshots. Two reproducer scenarios demonstrate how metadata commit failures lead to bad reference counts and leaked metadata blocks. The fix defers held_root updates to commit time, moves snapshot existence checks earlier to avoid unnecessary work, clears held_root before btree deletion to prevent stale references, and unlocks snapshot blocks before decrementing their reference counts.

This vulnerability causes inconsistent metadata snapshots in the device mapper thin provisioning subsystem, which may result in corrupted metadata state such as bad reference counts and leaked metadata blocks. This can affect the integrity of thin pool metadata, potentially leading to data management issues within the affected storage subsystem. There is no indication of remote exploitability or direct code execution, but metadata corruption can impact system stability and data reliability.

A fix has been implemented in the Linux kernel to address this issue by deferring held_root updates to commit time and improving snapshot handling logic. Users should apply the official kernel updates that include this fix once available. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not yet confirmed in the provided data; check the official Linux kernel advisories or distribution security updates for the current remediation guidance.