Executive brief
A vulnerability in the Linux kernel's device-mapper cache component could allow a local user to crash the system. The issue occurs when the system is configured in a specific 'passthrough' mode and handles simultaneous data writes to the same location. This results in a system 'kernel panic' or crash, potentially disrupting services and operations.
Technical details
A NULL pointer dereference exists in the Linux kernel's dm-cache target (drivers/md/dm-cache-target.c). In passthrough mode, when dm-cache attempts to invalidate a cache entry, a race condition can occur if a concurrent write happens to the same block. If the bio prison cell lock fails, the 'mg->cell' pointer remains NULL. The error handling path in 'invalidate_complete()' subsequently attempts to unlock and free this NULL pointer via 'dm_cell_unlock_v2()', leading to a kernel oops. The fix introduces a check to ensure 'mg->cell' is valid before attempting the unlock operation. This affects systems using dm-cache with the passthrough feature enabled.
Affected products
- Linux Linux Kernel 6.19.0-rc7
Timeline
- 2026-02-09: other: Patch authored
- 2026-06-01: patched: Patch committed to stable tree
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/01264a6a3a3ad7ac1d73443299cd5a9568002454
- https://git.kernel.org/stable/c/0aa745fea1f8dc81bcdd0a45e215b6706727b482
- https://git.kernel.org/stable/c/25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15
- https://git.kernel.org/stable/c/7d1f98d668ee34c1d15bdc0420fdd062f24a27c0
- https://git.kernel.org/stable/c/a2635d541a93fd111e743cf14b6275dc81be2abc
- https://git.kernel.org/stable/c/c7fb6bc864c4910b344dafa36dd5028e9b980768
- https://git.kernel.org/stable/c/df3b8ef06cc62de4fca5d2108e285085b3cffd44