AZL-112616: CVE-2026-99256 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix issue with background work locking
dm cache used a rwsemaphore for backgroundworklock. Write locks on rwsemaphores have strict owner semantics, but there was no guarantee that the process that locked backgroundworklock was the same process that unlocked it. This can be easily seen using a kernel compiled with CONFIGDEBUGRWSEMS. Given a dm cache device <cache>, run: 'dmsetup suspend <cache> && dmsetup resume <cache>'. This will trigger a kernel warning:
DEBUGRWSEMSWARNON((rwsemowner(sem) != current) && !rwsemtestoflags(sem, RWSEMNONSPINNABLE))
triggered by cacheresume(). To fix this, switch from a rwsemaphore to a spinlock and a wait queue. dm cache already has a wait queue and associated counter, migrationwait and nrallocatedmigrations, that was getting woken up when background work was getting completed, but wasn't actually used by anything. This is replaced by the backgroundwork queue and counter.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Azure Linux kernel package version 6.6.159.1-1 with device-mapper cache devices are relevant. The described trigger requires operating on a dm-cache device.
What action triggers the warning?
Suspending and then resuming a dm-cache device, for example with dmsetup suspend followed by dmsetup resume, can trigger the locking warning. The issue is readily visible when the kernel is compiled with CONFIG_DEBUG_RWSEMS.
Is there evidence in the provided data that this is remotely exploitable?
No. The provided information describes a local dm-cache management operation and does not identify any remote attack vector.