Executive brief
The Linux kernel's device mapper (dm) module contains a race condition when loading and unloading storage device tables concurrently. If two simultaneous table load operations occur where one succeeds and one fails, the code can access invalid memory, potentially causing a system crash or data corruption. This affects systems using device mapper for logical volume management or virtual storage.
Technical details
This is a race condition in the dm_setup_md_queue() function within drivers/md/dm.c. The vulnerable code walks the &md->table_devices list without holding a lock, while a concurrent dm_table_destroy() operation can simultaneously free devices via free_devices() -> dm_put_table_device(), leading to use-after-free memory access. The attack vector is local: an unprivileged user can trigger concurrent ioctl() calls to load and unload device mapper tables. The fix extends the mutex_lock(&md->table_devices_lock) to cover the entire device registration flow, ensuring atomic access to the list. Patches are available in Linux stable kernels via commit 5380c7f6335cc6d77eb77d065105e81155c4d9d3.
Affected products
- Linux Linux kernel multiple versions prior to fix (2.6.x through 7.x affected)
Timeline
- 2026-09-16: disclosed
- 2026-07-27: patched: Fix committed upstream