UBUNTU-CVE-2026-99136: Race Condition
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io->error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io->error and drop its reference between the read and the decrement. cryptdecpending then drops the last reference and completes the bio with the stale status - so a read that failed and was never decrypted, or a write that failed, is reported as successful. The read was placed before the decrement by commit b35f8caa0890 ("dm crypt: wait for endio to complete before destruction"), because that commit freed dmcryptio before calling bioendio. This is no longer the case, dmcryptio lives in the per-bio data now. Read io->error after atomicdecandtest instead. atomicdecandtest is fully ordered, so no additional barrier is needed.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Ubuntu systems using any of the listed kernel packages are in scope, including linux, linux-fips, linux-aws, linux-azure, linux-gcp, and their listed FIPS variants. The race is in the dm-crypt kernel code path, so exposure depends on use of dm-crypt-backed encrypted storage.
What conditions are needed for the race to cause an incorrect result?
A dm-crypt I/O operation must encounter an error while concurrent completion contexts race over the per-I/O error status and reference count. The flaw can cause a failed read that was not decrypted, or a failed write, to be reported as successful.
How can I tell whether this issue has affected my system?
The reported symptom is an I/O operation that actually failed but was completed with a successful status. The provided information does not include a specific log signature, detection command, or affected package version range.