GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89998 (GCVE-0-2026-89998)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
Title
dm: fix race when loading and unloading a table
Summary
In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dm_setup_md_queue walks &md->table_devices without any lock. If the walk races with dm_table_destroy -> free_devices -> dm_put_table_device, there is access to invalid memory. Fix this race by extending the lock over the list walk.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b02e35b81176c7d61dd441cc7a2e5c324a82444b (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0ea6e5ad4a5817e91f11b4cc1e022e575ed2e7ca (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a1af1884c960b98c621b6fe2fea1216b78c02152 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < af1f32ccf8051f4691ced11feb452b9d13561727 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 00ad6f9ed27f91925d4d3fb7aab50a60d774f998 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5380c7f6335cc6d77eb77d065105e81155c4d9d3 (git)
Affected: 0 , < 6.1.188 (semver)
Affected: 0 , < 6.6.157 (semver)
Affected: 0 , < 6.12.110 (semver)
Affected: 0 , < 6.18.51 (semver)
Affected: 0 , < 7.2.5 (semver)
guessed Create a notification for this product.
Linux Linux Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b02e35b81176c7d61dd441cc7a2e5c324a82444b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0ea6e5ad4a5817e91f11b4cc1e022e575ed2e7ca",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a1af1884c960b98c621b6fe2fea1216b78c02152",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "af1f32ccf8051f4691ced11feb452b9d13561727",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "00ad6f9ed27f91925d4d3fb7aab50a60d774f998",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5380c7f6335cc6d77eb77d065105e81155c4d9d3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.110",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.51",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix race when loading and unloading a table\n\nIf the userspace calls two concurrent table load ioctls and one of them\nsucceeds and the other fails, there is a race condition because\ndm_setup_md_queue walks \u0026md-\u003etable_devices without any lock. If the walk\nraces with dm_table_destroy -\u003e free_devices -\u003e dm_put_table_device, there\nis access to invalid memory.\n\nFix this race by extending the lock over the list walk."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is reached only through local DM_TABLE_LOAD ioctls on /dev/mapper/control (ctl_ioctl \u2192 table_load \u2192 dm_setup_md_queue walking md-\u003etable_devices). No network, Bluetooth, or physical-bus path loads a device-mapper table.\nAC:L - The attacker issues two concurrent table-load ioctls on a mapped device they created, owning both sides of the race: one load fails after populate_table added devices and dm_table_destroy frees them while the other walks the list. Device-mapper is a standard distro component, not a rare config.\nPR:L - ctl_ioctl requires capable(CAP_SYS_ADMIN). In the most severe reasonable deployment that capability is held by a container, CSI, or LVM/storage-stack administrator with delegated /dev/mapper/control rather than exclusive host root, matching kernel-CNA scoring of other device-mapper ioctl bugs as Low.\nUI:N - The attacker performs every step with its own ioctls (DM_DEV_CREATE then concurrent DM_TABLE_LOAD). No separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The use-after-free of struct table_device stays inside the host kernel\u0027s security authority. This is standard kernel memory corruption, not a VM, IOMMU, or sandbox boundary crossing.\nC:H - dm_setup_md_queue walks md-\u003etable_devices and dereferences td-\u003edm_dev.bdev after a concurrent dm_table_destroy has kfree\u0027d the table_device. Reclaiming that slab object yields an arbitrary kernel read, so confidentiality is High.\nI:H - The same use-after-free lets an attacker spray a replacement object so bd_link_disk_holder writes through an attacker-controlled bdev pointer, a classic heap UAF write and control-flow hijack primitive, so integrity is High.\nA:H - Walking a freed table_device list entry or calling bd_link_disk_holder on a dangling bdev causes a kernel oops, panic, or hang, which is a complete availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:41:13.070Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b02e35b81176c7d61dd441cc7a2e5c324a82444b"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ea6e5ad4a5817e91f11b4cc1e022e575ed2e7ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1af1884c960b98c621b6fe2fea1216b78c02152"
        },
        {
          "url": "https://git.kernel.org/stable/c/af1f32ccf8051f4691ced11feb452b9d13561727"
        },
        {
          "url": "https://git.kernel.org/stable/c/00ad6f9ed27f91925d4d3fb7aab50a60d774f998"
        },
        {
          "url": "https://git.kernel.org/stable/c/5380c7f6335cc6d77eb77d065105e81155c4d9d3"
        }
      ],
      "title": "dm: fix race when loading and unloading a table",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89998",
    "datePublished": "2026-09-16T10:33:10.012Z",
    "dateReserved": "2026-09-11T19:38:34.780Z",
    "dateUpdated": "2026-09-16T14:41:13.070Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89998\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-16T11:17:11.060\",\"lastModified\":\"2026-09-16T15:18:23.410\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm: fix race when loading and unloading a table\\n\\nIf the userspace calls two concurrent table load ioctls and one of them\\nsucceeds and the other fails, there is a race condition because\\ndm_setup_md_queue walks \u0026md-\u003etable_devices without any lock. If the walk\\nraces with dm_table_destroy -\u003e free_devices -\u003e dm_put_table_device, there\\nis access to invalid memory.\\n\\nFix this race by extending the lock over the list walk.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/dm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b02e35b81176c7d61dd441cc7a2e5c324a82444b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"0ea6e5ad4a5817e91f11b4cc1e022e575ed2e7ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"a1af1884c960b98c621b6fe2fea1216b78c02152\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"af1f32ccf8051f4691ced11feb452b9d13561727\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"00ad6f9ed27f91925d4d3fb7aab50a60d774f998\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"5380c7f6335cc6d77eb77d065105e81155c4d9d3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.1.188\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6.157\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12.110\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18.51\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.2.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/dm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.5\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00ad6f9ed27f91925d4d3fb7aab50a60d774f998\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0ea6e5ad4a5817e91f11b4cc1e022e575ed2e7ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5380c7f6335cc6d77eb77d065105e81155c4d9d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a1af1884c960b98c621b6fe2fea1216b78c02152\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af1f32ccf8051f4691ced11feb452b9d13561727\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b02e35b81176c7d61dd441cc7a2e5c324a82444b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.