Executive brief
A memory leak vulnerability was identified in the Linux kernel's device-mapper cache component. This component is responsible for managing data caching on storage devices to improve performance. An exploit could allow a local user to gradually exhaust system memory by triggering specific error conditions during storage management operations, potentially leading to system instability or a denial of service.
Technical details
A memory leak exists in the 'dm_cache_metadata_abort' function within the Linux kernel's device-mapper cache (dm-cache) driver. The vulnerability occurs when the kernel fails to acquire 'root_lock' because the block manager is in a read-only state; in this failure path, a temporary 'block_manager' object allocated via 'dm_block_manager_create' is not properly released. This can be reliably triggered by reloading a DM table while metadata is read-only or through races in cache mode updates during concurrent 'metadata_operation_failed' calls. An attacker with local privileges to manage DM tables could exploit this to exhaust kernel memory. The fix introduces a 'WRITE_LOCK_OR_GOTO' macro to ensure proper cleanup on lock acquisition failure.
Affected products
- Linux Linux Kernel Fixed in 044ca491d4086dc5bf233e9fcb71db52df32f633 and related stable branches
Timeline
- 2026-03-04: patched: Initial patch authored by Ming-Hung Tsai
- 2026-06-24: disclosed: CVE-2026-53060 published
References
- https://git.kernel.org/stable/c/044ca491d4086dc5bf233e9fcb71db52df32f633
- https://git.kernel.org/stable/c/14f60e957f34f95a626caec76a8fae88cf4c397f
- https://git.kernel.org/stable/c/15c30997dca681f90dbf2d45ee629c1828bf0c0d
- https://git.kernel.org/stable/c/322a3b70368d49e39591fe9fc6c07d262128b05f
- https://git.kernel.org/stable/c/4311ca59a1891d33c4c8b7946f98c34f167fe833
- https://git.kernel.org/stable/c/6b97cc7a42905755c56bbddc33aa8b792205caee
- https://git.kernel.org/stable/c/b0bd35535bdb6f58505f3a30ee5793986943997a