HIGH Introduced in 2.6.12
dm TableDevices UAF
CVE-2026-89998
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dm_setup_md_queue walks &md->table_devices without any lock. If the walk races with dm_table_destroy -> free_devices -> dm_put_table_device, there is access to invalid memory. Fix this race by extending the lock over the list walk.
02KernelScan AI Analysis
Risk summary
A local attacker with CAP_SYS_ADMIN can trigger a use-after-free in the device-mapper subsystem by issuing two concurrent table load ioctls where one succeeds and the other fails. The race can corrupt kernel heap memory, potentially leading to privilege escalation or denial of service. Systems where unprivileged users cannot obtain CAP_SYS_ADMIN are not at risk from this specific path.
Vulnerability analysis
When two concurrent device-mapper table load ioctls race—one succeeding and the other failing—the successful path walks the mapped device's table device list without holding the protecting lock, while the failing path tears down its table and frees those same list entries. This results in a use-after-free where the successful path accesses memory that the failing path has already released. The fix extends the existing mutex over the entire list walk and holder-registration loop, and restructures the error-handling paths so the lock is held during cleanup, preventing the teardown from freeing entries while another thread is still iterating over them. The vulnerability is reachable locally by any process holding CAP_SYS_ADMIN in the init namespace that issues concurrent DM table load ioctls.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 6.1.2 | 6.1.188 | b02e35b81176 |
| 6.0 | 6.0.16 | 6.1 | 0ea6e5ad4a58 |
| 6.6 | 2.6.12 | 6.6.157 | a1af1884c960 |
| 6.12 | 2.6.12 | 6.12.110 | af1f32ccf805 |
| 7.2 | 2.6.12 | 7.2.5 | 5380c7f6335c |
| mainline | 2.6.12 | 7.3-rc1 | — |
| 6.18 | 2.6.12 | 6.18.51 | 00ad6f9ed27f |
| cip/6.12 | 2.6.12 | 6.12.111-cip32 | a1af1884c960 |