CVE-2026-89998: dm: fix race when loading and unloading a table
In the Linux kernel, the following vulnerability has been resolved:
dm: fix race when loading and unloading a table
If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dmsetupmdqueue walks &md->tabledevices without any lock. If the walk races with dmtabledestroy -> freedevices -> dmputtabledevice, there is access to invalid memory.
Fix this race by extending the lock over the list walk.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the race?
Userspace must issue two table-load ioctls concurrently for the same device-mapper context. The race occurs when one table load succeeds while the other fails, allowing table setup to walk table_devices as the failed table is destroyed.
What is the impact of a successful race?
The kernel can access invalid memory when dm_setup_md_queue walks the table_devices list concurrently with table destruction and removal of table devices.
What change addresses the issue?
The fix extends locking to cover the table_devices list walk, preventing dm_setup_md_queue from racing with dm_table_destroy and its device cleanup.