CVE-2026-53061: Linux Kernel dm-cache Dirty Mapping Data Loss Vulnerability

Technical summary

The vulnerability exists in the dm-cache component of the Linux device mapper. The dirty mapping validation for passthrough mode transitions was performed during table creation (ctr phase), based on an earlier assumption that table reloads always follow suspension. LVM's table preload mechanism violates this assumption by allowing concurrent metadata updates. When a preloaded passthrough-mode table is resumed with dirty blocks present in the cache metadata, the stale validation result permits those dirty mappings to load into passthrough mode, where they are no longer protected. The fix relocates the dirty mapping check to the preresume phase, ensuring validation occurs immediately before table activation when metadata state is finalized. The unused function dm_cache_metadata_all_clean is removed as part of this correction.

Business impact

This vulnerability can lead to silent data corruption or loss on systems using dm-cache in writeback mode with table reloading. Organizations relying on LVM snapshots, live migrations, or table modifications could inadvertently load dirty cache blocks into a mode that does not handle them correctly, resulting in data integrity violations. The impact is amplified in virtualized environments or storage clusters where table preloading is common. Recovery may be impossible if the corruption occurs on production volumes.

Affected systems

The Linux kernel dm-cache subsystem is affected across all versions that contain the vulnerable code path. This particularly impacts systems using LVM with dm-cache, including containerized and virtualized deployments that perform dynamic table reloading. Any distribution shipping an affected kernel version is susceptible. The vulnerability requires local access and typically elevated privileges (cache administrator or root equivalent), limiting exposure to trusted users or containerized workloads with sufficient capabilities.

Exploitability

Exploitation requires local access and the ability to manage device mapper tables (typically requiring root or elevated privileges). The attack is deterministic: an attacker must (1) create a writeback cache with migration_threshold set to 0, (2) preload a passthrough-mode table, (3) write data to dirty cache blocks, and (4) resume the preloaded table. No network vector or privilege escalation is needed; the vulnerability is triggered by normal administrative operations conducted maliciously or by misconfiguration. The CVSS score of 5.5 reflects local attack surface, low complexity, and availability impact without confidentiality or integrity loss in the traditional sense—though data loss itself represents an availability violation.

Remediation

Apply kernel patches that move dirty mapping validation from the table creation phase to the preresume phase. Verify the patch is included in your kernel version and rebuild or update your system. Until patched, administrators should avoid rapid table reloads or preloading passthrough-mode tables on active writeback caches. If using LVM snapshots or live migrations with dm-cache, delay these operations until dirty blocks are migrated or the cache is flushed. Restrict local access to device mapper administration to trusted users only.

Patch guidance

Check your Linux kernel version against vendor advisory guidance from your distribution (Red Hat, Ubuntu, Debian, SUSE, etc.). The fix involves patching the dm-cache code in drivers/md/dm-cache-target.c to move the dirty mapping check into the preresume callback. Most distributions will release updated kernel packages; install them using your package manager (apt, yum, zypper, etc.). Verify the patch is applied by confirming the preresume-phase validation is present in the binary or source. Reboot may be required depending on your kernel update mechanism. Test table reloading operations in non-production environments before rolling out to production.

Detection guidance

Monitor kernel logs for dm-cache table reload operations and preresume events. Look for sequences where passthrough tables are preloaded on writeback caches, especially with migration_threshold set to 0 or low values. Audit device mapper configuration changes using 'dmsetup' and LVM commands. If data corruption is suspected after a table reload, check cache metadata integrity with dm-cache diagnostic tools. Intrusion detection systems should flag unusual patterns of rapid table creation and reload cycles on the same cache volume. Ensure audit logging is enabled for device mapper administrative commands.

Why prioritize this

Although the CVSS score is moderate (5.5), this vulnerability should be prioritized because it directly threatens data integrity and can cause silent, unrecoverable loss on production storage. The attack surface is local-only and requires privileges, reducing risk in most environments, but organizations using LVM with dm-cache—common in enterprise storage, virtualization, and containerized deployments—face real exposure. The deterministic nature of the exploit means misconfiguration or malicious administration will reliably trigger the flaw. Prioritize patching systems where dm-cache is actively used in writeback mode with dynamic table management.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector Local (the primary limitation), Attack Complexity Low (normal admin operations trigger it), Privileges Required (elevated, not high), User Interaction None, Scope Unchanged, and Availability impact High (data loss is an availability violation). Confidentiality and Integrity are scored as None because the attack does not expose or corrupt data in transit; rather, it permits unprotected handling of data already marked dirty. However, the practical impact—silent data loss—warrants close monitoring and rapid patching despite the moderate numerical score.

Frequently asked questions