EUVD-2026-80606
GHSA-qxqq-x3cw-322m
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
dm ioctls require CAP_SYS_ADMIN (PR:H) and the defect is a non-deterministic race (AC:H); UAF causes a crash (A:H) with no disclosure (C:N) and only incidental memory corruption (I:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
dm: fix race when loading and unloading a table
If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dm_setup_md_queue walks &md->table_devices without any lock. If the walk races with dm_table_destroy -> free_devices -> dm_put_table_device, there is access to invalid memory.
Fix this race by extending the lock over the list walk.
AnalysisAI
A use-after-free race condition in the Linux kernel's device-mapper (dm) subsystem can be triggered when two concurrent DM_TABLE_LOAD ioctls are issued against the same device and one succeeds while the other fails, allowing the unlocked walk of md->table_devices in dm_setup_md_queue to dereference memory already freed by dm_table_destroy. The vendor scored this 7.8, but our independent assessment places it at CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - exploitation requires local, root-equivalent CAP_SYS_ADMIN access to /dev/mapper/control and winning a narrow, non-deterministic timing window, so the realistic worst case is a host crash or denial of service rather than code execution or data disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires LOCAL access with the CAP_SYS_ADMIN capability to issue device-mapper control ioctls (DM_TABLE_LOAD) via /dev/mapper/control - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a local, root-gated race-condition use-after-free in the Linux kernel device-mapper (dm) subsystem, materially over-scored by the vendor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux 6.1.188, 6.6.157, 6.12.110, 6.18.51 or 7.2.5 (7.3-rc1 contains the mainline fix), or apply the corresponding stable backport commits linked from the CVE record at git.kernel.org. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Patch available per vendor advisory for the 6.1, 6.6, 6.12, 6.18, and 7.2 stable branches; within 24 hours, inventory all Linux hosts, hypervisors, and container nodes using device-mapper, record kernel versions against those branches, and restrict /dev/mapper/control and CAP_SYS_ADMIN to essential trusted administrators as an interim precaution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today