Executive brief
A vulnerability in the Linux kernel's device-mapper (dm) cache component can cause system write operations to hang when the cache is in passthrough mode. This component is responsible for managing data storage caching to improve performance; an exploit or trigger of this bug could lead to a local denial-of-service by freezing disk write activities. This would impact system availability and could potentially lead to data corruption if the system is forced to reboot during a hang.
Technical details
A vulnerability in the `invalidate_remove()` function of the Linux kernel's `dm-cache` target leads to a write hang when operating in passthrough mode. The root cause is incomplete logic for handling write hit BIOs (block I/O operations) after cache invalidation; the function sets up remapping for the `overwrite_bio` but fails to submit it, causing the I/O request to remain pending indefinitely. The fix introduces an `invalidate_committed()` continuation to ensure remapped writes are submitted to the cache origin after metadata commit. This issue affects kernels from version 4.12 up to the patched versions in the 6.x and 7.x branches.
Affected products
- Linux Linux Kernel 4.12 to 7.0.10
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://git.kernel.org/stable/c/05798d091ebcfb6d68228890e593f209e8ac940d
- https://git.kernel.org/stable/c/4ca8b8bd952df7c3ccdc68af9bd3419d0839a04b
- https://git.kernel.org/stable/c/64d6519b00be4116d365bd31f33a5e5ce2944c1a
- https://git.kernel.org/stable/c/9fa18d0b981776b190ca4632942a7c2174052b78
- https://git.kernel.org/stable/c/b8ace9e96983abb20ccf39edce8a60f1bb0b83d8
- https://git.kernel.org/stable/c/ecb10c193cbebf5e6984246a9b4ff1f95d45ed87