Executive brief
A race condition was identified in the Linux kernel's device-mapper (dm) cache policy component. This component is responsible for managing how data is cached on storage drives to improve performance. An attacker or a malfunctioning process could trigger a specific sequence of events that causes the system to corrupt its internal cache tracking tables, potentially leading to a system crash or data inconsistency.
Technical details
A check-then-act race condition exists in the smq_invalidate_mapping() function within drivers/md/dm-cache-policy-smq.c. The vulnerability occurs because the 'e->allocated' check was performed outside the 'mq->lock' critical section. Concurrent invalidation requests can both observe an entry as allocated; the first to acquire the lock frees the entry, while the second proceeds with a stale result, attempting to delete the entry from queues and hash tables it no longer belongs to. This can lead to SMQ queue/hash table corruption or a double-free scenario in free_entry(). The fix moves the allocation check inside the spinlock to ensure atomicity.
Affected products
- Linux Linux Kernel drivers/md/dm-cache-policy-smq.c
Timeline
- 2026-05-29: other: Patch authored
- 2026-06-19: patched: Commits merged into stable branches
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/03ffe1112ed88bb3a9bd0b971549bf4d64bfc59a
- https://git.kernel.org/stable/c/13da856c86fb8c2ccab95034fd77da1bb2c2a17c
- https://git.kernel.org/stable/c/42ff6774ecd9d7f70d599cb71ff64373a1da4948
- https://git.kernel.org/stable/c/b4892561552d671bd8c4da5ebb70e9fbb1ec446e
- https://git.kernel.org/stable/c/c242c7af2aecf0b538b8623bdb86b8b441da38d9
- https://git.kernel.org/stable/c/c57570fba24016ec25ec046ab44db39143fb7a64
- https://git.kernel.org/stable/c/d3f0a606b9f278ece8a0df626ded9c4044071235