CVE-2026-89998

dm: fix race when loading and unloading a table

State: Published
Severity: 7.8 High
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dm: fix race when loading and unloading a table

If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dm_setup_md_queue walks &md->table_devices without any lock. If the walk races with dm_table_destroy -> free_devices -> dm_put_table_device, there is access to invalid memory.

Fix this race by extending the lock over the list walk.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	773bfda35c9511734d7f898e2ee73cd60d2a3f38 to before b02e35b81176c7d61dd441cc7a2e5c324a82444bAffected 1a581b72169968f4154b5793828f3bc28b258b35 to before 0ea6e5ad4a5817e91f11b4cc1e022e575ed2e7caAffected 1a581b72169968f4154b5793828f3bc28b258b35 to before a1af1884c960b98c621b6fe2fea1216b78c02152Affected 1a581b72169968f4154b5793828f3bc28b258b35 to before af1f32ccf8051f4691ced11feb452b9d13561727Affected 1a581b72169968f4154b5793828f3bc28b258b35 to before 00ad6f9ed27f91925d4d3fb7aab50a60d774f998Affected 1a581b72169968f4154b5793828f3bc28b258b35 to before 5380c7f6335cc6d77eb77d065105e81155c4d9d3Affected 600593707c239bb99486925d65540a5020bc1e58Affected 6.1.2 to before 6.1.188Affected 6.0.16 to before 6.1Affected
LinuxLinux	6.2Affected before 6.2Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

773bfda35c9511734d7f898e2ee73cd60d2a3f38 to before b02e35b81176c7d61dd441cc7a2e5c324a82444bAffected
1a581b72169968f4154b5793828f3bc28b258b35 to before 0ea6e5ad4a5817e91f11b4cc1e022e575ed2e7caAffected
1a581b72169968f4154b5793828f3bc28b258b35 to before a1af1884c960b98c621b6fe2fea1216b78c02152Affected
1a581b72169968f4154b5793828f3bc28b258b35 to before af1f32ccf8051f4691ced11feb452b9d13561727Affected
1a581b72169968f4154b5793828f3bc28b258b35 to before 00ad6f9ed27f91925d4d3fb7aab50a60d774f998Affected
1a581b72169968f4154b5793828f3bc28b258b35 to before 5380c7f6335cc6d77eb77d065105e81155c4d9d3Affected
600593707c239bb99486925d65540a5020bc1e58Affected
6.1.2 to before 6.1.188Affected
6.0.16 to before 6.1Affected

LinuxLinux

6.2Affected
before 6.2Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.