EUVD-2026-80605
GHSA-qw6j-46hc-qq7g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local dm ioctls require CAP_SYS_ADMIN (PR:H) and success depends on winning a race (AC:H); impact is a UAF kernel crash (A:H) with no data leak (C:N) and only incidental integrity effect (I:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
dm: fix resume-vs-remove race
If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in __dm_destroy. The result is that the table is destroyed without calling the postsuspend method.
Dm targets expect that they may be removed only after the postsuspend method method was called. If we break this expectation, it can cause misbehavior in various targets. For example - in the dm-integrity target, the reboot notifier is not unregistered, leading to use-after-free.
Fix this bug by refusing to resume if the device is being destroyed.
AnalysisAI
Local attackers holding CAP_SYS_ADMIN can crash or destabilize the Linux kernel by racing the device-mapper resume ioctl against a concurrent device removal on the same mapped device, so the table is torn down in __dm_destroy without the postsuspend callback the dm targets depend on. The most concrete consequence documented is a use-after-free in the dm-integrity target, whose reboot notifier is left registered when postsuspend is skipped, while other targets may simply misbehave; the independent assessment rates this as a privilege-gated, non-deterministic denial-of-service rather than code execution or data disclosure, materially below the vendor's 7.8 HIGH score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access with CAP_SYS_ADMIN to issue device-mapper control ioctls (resume and remove) against the same dm device, and the attacker must win a race so the resume completes after __dm_destroy has suspended the device. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a local privilege-gated denial-of-service issue whose real-world risk is materially lower than the vendor's 7.8 HIGH rating suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fixes by moving to a kernel that contains the stable releases named in the advisory: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, or 7.2.5 on their respective branches, or 7.3-rc1 or later on mainline; the individual stable commits (for example https://git.kernel.org/stable/c/9757367bcf1d5d2c50b94d005abca21f3eedd7c3 and its siblings) can be cherry-picked by vendors maintaining their own trees, and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-89997 tracks the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify affected Linux hosts running device-mapper and dm-integrity, then apply the vendor kernel/device-mapper update per your distribution advisory (Patch available per vendor advisory; no exact fix version was provided in the supplied context); if immediate patching is not possible, restrict CAP_SYS_ADMIN to essential personnel, limit concurrent device-mapper resume and device-removal operations where feasible, and monitor for kernel crashes or dm-integrity notifier errors. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today