CVE-2026-99256
Received Received - Intake

Race Condition in Linux Kernel dm-cache Background Work Locking

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rw_semaphore for background_work_lock. Write locks on rw_semaphores have strict owner semantics, but there was no guarantee that the process that locked background_work_lock was the same process that unlocked it. This can be easily seen using a kernel compiled with CONFIG_DEBUG_RWSEMS. Given a dm cache device <cache>, run: 'dmsetup suspend <cache> && dmsetup resume <cache>'. This will trigger a kernel warning: DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)) triggered by cache_resume(). To fix this, switch from a rw_semaphore to a spinlock and a wait queue. dm cache already has a wait queue and associated counter, migration_wait and nr_allocated_migrations, that was getting woken up when background work was getting completed, but wasn't actually used by anything. This is replaced by the background_work queue and counter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-99256
EUVD
EUVD-2026-115767

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux b29d4986d0da1a27cd35917cdb433672f5c95d7f
Linux Linux b29d4986d0da1a27cd35917cdb433672f5c95d7f
Linux Linux b29d4986d0da1a27cd35917cdb433672f5c95d7f
Linux Linux b29d4986d0da1a27cd35917cdb433672f5c95d7f
Linux Linux b29d4986d0da1a27cd35917cdb433672f5c95d7f
Linux Linux b29d4986d0da1a27cd35917cdb433672f5c95d7f
Linux Linux b29d4986d0da1a27cd35917cdb433672f5c95d7f
Linux Linux b29d4986d0da1a27cd35917cdb433672f5c95d7f
Linux Linux 4.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper locking in the device mapper (dm) cache subsystem. The dm cache used a rw_semaphore for background work locking, but write locks on rw_semaphores require strict owner semantics. There was no guarantee the same process locking the semaphore would unlock it, which could lead to kernel warnings or potential deadlocks. The fix replaces the rw_semaphore with a spinlock and wait queue to ensure proper synchronization.

Detection Guidance

To detect this vulnerability, check for kernel warnings related to rw_semaphore usage in dm cache. Run 'dmsetup suspend <cache> && dmsetup resume <cache>' on a dm cache device. If the kernel is compiled with CONFIG_DEBUG_RWSEMS, it will trigger a warning indicating the issue.

Impact Analysis

This vulnerability could cause kernel warnings or instability when suspending and resuming a dm cache device. In severe cases, it might lead to system hangs or crashes, particularly if the kernel is compiled with CONFIG_DEBUG_RWSEMS. Users relying on dm cache for storage management could experience disruptions during these operations.

Mitigation Strategies

Apply the kernel patch that replaces the rw_semaphore with a spinlock and wait queue in dm cache. Update your Linux kernel to a version that includes this fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99256. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...