HIGH Introduced in 2.6.36
dm Resume Race
CVE-2026-89997
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in __dm_destroy. The result is that the table is destroyed without calling the postsuspend method. Dm targets expect that they may be removed only after the postsuspend method method was called. If we break this expectation, it can cause misbehavior in various targets. For example - in the dm-integrity target, the reboot notifier is not unregistered, leading to use-after-free. Fix this bug by refusing to resume if the device is being destroyed.
02KernelScan AI Analysis
Risk summary
A local attacker can race the device-mapper resume and remove ioctls to trigger a use-after-free in kernel memory. The bug exists in all supported stable branches since the original 2.6.12 import. Exploitation requires winning a narrow race window but can lead to kernel code execution or denial of service.
Vulnerability analysis
When the device-mapper resume and remove operations are issued at the same time, the device can be resumed after it has already started being destroyed. This causes the mapped table to be torn down without completing the normal cleanup that target devices expect. In the dm-integrity target, for example, a callback is left registered and later dereferenced after the target's memory is freed, producing a use-after-free. The fix prevents this by refusing to resume a device that is already being destroyed. The vulnerable path is reachable by any local process with the ability to issue device-mapper ioctls.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 2.6 | 2.6.35.4 | 2.6.36 | 9757367bcf1d |
| 5.10 | 2.6.36 | 5.10.270 | 1ede2bce2bd6 |
| 5.15 | 2.6.36 | 5.15.221 | 3f04e6520d9a |
| 6.1 | 2.6.36 | 6.1.188 | 94f3d399c1dd |
| 6.12 | 2.6.36 | 6.12.110 | 36177beff2a9 |
| 6.18 | 2.6.36 | 6.18.51 | 94380ecd5ff9 |
| 6.6 | 2.6.36 | 6.6.157 | 3b59530b14fd |
| 7.2 | 2.6.36 | 7.2.5 | 44b43ec132f1 |
| mainline | 2.6.36 | 7.3 | — |
| cip/5.10 | 2.6.36 | 5.10.271-cip78 | 9757367bcf1d |
| cip/6.1 | 2.6.36 | 6.1.189-cip61 | 3f04e6520d9a |
| cip/6.1-rt | 2.6.36 | 6.1.189-cip61-rt32 | 3f04e6520d9a |
| cip/6.12 | 2.6.36 | 6.12.111-cip32 | 3b59530b14fd |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |