CVE-2026-89997 (GCVE-0-2026-89997)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-19 08:56
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in __dm_destroy. The result is that the table is destroyed without calling the postsuspend method. Dm targets expect that they may be removed only after the postsuspend method method was called. If we break this expectation, it can cause misbehavior in various targets. For example - in the dm-integrity target, the reboot notifier is not unregistered, leading to use-after-free. Fix this bug by refusing to resume if the device is being destroyed.
References
Impacted products
Vendor Product Version
Linux Linux Version: 3f77316de0ec0fd208467fbee8d9edc70e2c73b2
Version: 3f77316de0ec0fd208467fbee8d9edc70e2c73b2
Version: 3f77316de0ec0fd208467fbee8d9edc70e2c73b2
Version: 3f77316de0ec0fd208467fbee8d9edc70e2c73b2
Version: 3f77316de0ec0fd208467fbee8d9edc70e2c73b2
Version: 3f77316de0ec0fd208467fbee8d9edc70e2c73b2
Version: 3f77316de0ec0fd208467fbee8d9edc70e2c73b2
Version: 3f77316de0ec0fd208467fbee8d9edc70e2c73b2
Version: 305b06f7334dd43bc952b525d7232f4cae7c3818
Version: 2.6.35.4   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9757367bcf1d5d2c50b94d005abca21f3eedd7c3",
              "status": "affected",
              "version": "3f77316de0ec0fd208467fbee8d9edc70e2c73b2",
              "versionType": "git"
            },
            {
              "lessThan": "1ede2bce2bd640605df83db1356fd727159bc9ed",
              "status": "affected",
              "version": "3f77316de0ec0fd208467fbee8d9edc70e2c73b2",
              "versionType": "git"
            },
            {
              "lessThan": "3f04e6520d9a53adb1d1daf4dc5d31a60fc77d1f",
              "status": "affected",
              "version": "3f77316de0ec0fd208467fbee8d9edc70e2c73b2",
              "versionType": "git"
            },
            {
              "lessThan": "94f3d399c1ddba763c1c5a6501f7375d533d789f",
              "status": "affected",
              "version": "3f77316de0ec0fd208467fbee8d9edc70e2c73b2",
              "versionType": "git"
            },
            {
              "lessThan": "3b59530b14fde693e41d8e39bc326df6cbf07b76",
              "status": "affected",
              "version": "3f77316de0ec0fd208467fbee8d9edc70e2c73b2",
              "versionType": "git"
            },
            {
              "lessThan": "36177beff2a9df035991ad8d16ccf8d363ed93ee",
              "status": "affected",
              "version": "3f77316de0ec0fd208467fbee8d9edc70e2c73b2",
              "versionType": "git"
            },
            {
              "lessThan": "94380ecd5ff9b2a2b9f6e8a0b5c465159ccfaf71",
              "status": "affected",
              "version": "3f77316de0ec0fd208467fbee8d9edc70e2c73b2",
              "versionType": "git"
            },
            {
              "lessThan": "44b43ec132f1cf3275ecc182d0c82f50c3c4c3d5",
              "status": "affected",
              "version": "3f77316de0ec0fd208467fbee8d9edc70e2c73b2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "305b06f7334dd43bc952b525d7232f4cae7c3818",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.36",
              "status": "affected",
              "version": "2.6.35.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.35.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix resume-vs-remove race\n\nIf the user issues the resume ioctl and the remove ioctl at the same\ntime, it may be possible that the device is resumed after it is suspended\nin __dm_destroy. The result is that the table is destroyed without\ncalling the postsuspend method.\n\nDm targets expect that they may be removed only after the postsuspend\nmethod method was called. If we break this expectation, it can cause\nmisbehavior in various targets. For example - in the dm-integrity target,\nthe reboot notifier is not unregistered, leading to use-after-free.\n\nFix this bug by refusing to resume if the device is being destroyed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local device-mapper ioctls on /dev/mapper/control (ctl_ioctl \u2192 DM_DEV_SUSPEND resume and DM_DEV_REMOVE \u2192 dm_resume racing __dm_destroy). No network, Bluetooth, or physical-bus path feeds this race.\nAC:L - The attacker issues concurrent resume and remove ioctls on a mapped device they control, owning both sides of the race. __dm_destroy waits for holders while resume already holds a reference, so the window is reliably hit without victim state or an uncontrolled memory layout.\nPR:L - ctl_ioctl requires capable(CAP_SYS_ADMIN). In the most severe reasonable deployment that capability is held by a container, CSI, or LVM/storage-stack administrator with delegated /dev/mapper/control rather than exclusive host root, matching kernel-CNA scoring of other device-mapper ioctl bugs as Low.\nUI:N - The attacker performs every step with its own ioctls (create and optionally suspend the mapped device, then concurrent resume and remove). No separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The use-after-free and resulting kernel corruption stay inside the host kernel\u0027s security authority. This is standard kernel memory corruption, not a VM, IOMMU, or sandbox boundary crossing.\nC:H - Skipping postsuspend after resume leaves target objects live after dtr frees them, including the dm-integrity reboot notifier and the dm-snapshot origin list. That use-after-free lets an attacker reclaim the object and obtain an arbitrary kernel read.\nI:H - The same use-after-free (global origin-list entry, reboot notifier, and restarted dm-thin/dm-cache work) is kernel memory corruption that can be turned into an arbitrary write and control-flow hijack, not merely on-disk integrity loss.\nA:H - Use-after-free of target private data, list corruption on _dm_origins, and BUG_ON in dm_integrity_dtr when I/O remains in-progress cause a kernel oops, panic, or hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:56:11.292Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9757367bcf1d5d2c50b94d005abca21f3eedd7c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ede2bce2bd640605df83db1356fd727159bc9ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f04e6520d9a53adb1d1daf4dc5d31a60fc77d1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/94f3d399c1ddba763c1c5a6501f7375d533d789f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b59530b14fde693e41d8e39bc326df6cbf07b76"
        },
        {
          "url": "https://git.kernel.org/stable/c/36177beff2a9df035991ad8d16ccf8d363ed93ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/94380ecd5ff9b2a2b9f6e8a0b5c465159ccfaf71"
        },
        {
          "url": "https://git.kernel.org/stable/c/44b43ec132f1cf3275ecc182d0c82f50c3c4c3d5"
        }
      ],
      "title": "dm: fix resume-vs-remove race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89997",
    "datePublished": "2026-09-16T10:33:09.302Z",
    "dateReserved": "2026-09-11T19:38:34.780Z",
    "dateUpdated": "2026-10-19T08:56:11.292Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.