Executive brief
The Linux kernel's device mapper (dm) subsystem controls how storage devices are mapped and managed in the system. A race condition allows a device to be resumed after it should have been suspended during removal, causing the device's configuration table to be destroyed improperly. This can lead to use-after-free errors and system instability, particularly affecting dm-integrity which manages data integrity verification.
Technical details
This is a race condition (CWE-362) in the Linux kernel's device mapper subsystem in drivers/md/dm.c. The vulnerability occurs when a resume ioctl and remove ioctl are issued simultaneously; the device may be resumed after __dm_destroy has suspended it, bypassing the required postsuspend callback. Dm targets rely on postsuspend being called before removal; violating this invariant causes misbehavior. The attack vector is local (ioctl-based) and requires no authentication, though it requires the ability to issue ioctls to the dm device. The fix adds a check for the DMF_FREEING flag to refuse resume operations when device destruction is in progress. The patch was committed upstream and backported to multiple stable kernel versions.
Affected products
- Linux Linux kernel Multiple versions from 2.6.x through 6.x and later
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-07-27: patched: Fix committed upstream by Mikulas Patocka