CVE-2026-53062: Linux Kernel dm-cache SMQ Race Condition in Passthrough Mode

Technical summary

CVE-2026-53062 is a synchronization vulnerability in the Linux kernel's dm-cache subsystem, specifically in the SMQ (Sorted Multiqueue) cache policy's invalidate_mapping operation. In passthrough mode, the invalidate_mapping function lacks necessary locking when called concurrently from multiple worker threads, creating data races on the allocated blocks counter and potential use-after-free conditions on internal policy structures. The vulnerability manifests when cache blocks are invalidated concurrently during writes, as demonstrated by the provided reproduction steps involving FIO workloads against a passthrough-mode cache device. The existing FIXME comment in smq_invalidate_mapping() does not address passthrough mode since migration tasks do not operate there, but the function still requires synchronization for safe concurrent block invalidation.

Business impact

Organizations relying on Linux-based storage systems with device mapper caching in passthrough mode face potential data corruption and system instability. A local attacker could crash the kernel or corrupt filesystem metadata by triggering concurrent cache block invalidation. This is particularly concerning for containerized environments, multi-tenant cloud platforms, and storage appliances where local access is accessible to unprivileged users or where cache passthrough mode is used for performance tuning during maintenance windows.

Affected systems

The vulnerability affects Linux kernel versions using the dm-cache subsystem with the SMQ cache policy in passthrough mode. Any system with an active cache device configured with the smq policy and operating in passthrough mode is potentially vulnerable. The issue does not affect writethrough or writeback modes to the same extent, as passthrough mode specifically triggers the concurrent invalidation pattern described. Kernel versions prior to the patch are affected; the patch availability should be verified against the Linux kernel development repository.

Exploitability

The vulnerability requires local access to the system and the ability to perform concurrent I/O operations against a cache device in passthrough mode. The attack is straightforward: configure a cache in passthrough mode and perform multi-threaded write operations with I/O block sizes matching cache block sizes. No authentication bypass or privilege escalation is required beyond initial local access. The race condition is reliably reproducible via the provided steps using standard tools like dmsetup and fio, making practical exploitation readily achievable by users with local access privileges.

Remediation

Apply the Linux kernel patch that adds proper locking to the smq_invalidate_mapping() function to synchronize access in passthrough mode. The fix involves protecting the invalidate_mapping operation with appropriate mutex or spinlock mechanisms to ensure atomic updates to the allocated blocks counter and safe concurrent access to internal cache policy data structures. Affected organizations should track Linux kernel releases and apply patches as they become available through their distribution channels.

Patch guidance

Verify the availability of a patched Linux kernel version from your distribution maintainer. For systems running unpatched kernels with dm-cache in passthrough mode, immediately audit cache configuration—if passthrough mode is not actively required, switch the cache to writethrough or writeback mode. If passthrough mode is necessary, prioritize kernel patching as part of the next scheduled maintenance window. Check your distribution's security advisories and kernel release notes for the specific version containing the fix; do not rely on automatic updates without testing in non-production environments first due to potential storage layer implications.

Detection guidance

Monitor for kernel log messages indicating use-after-free errors, NULL pointer dereferences, or data consistency warnings related to dm-cache operations. Observe dmsetup status output for the cache device: significant mismatches between the demoted block count and the original cached block count may indicate the race condition has occurred. Enable kernel address sanitizer (KASAN) or dynamic debugging in test environments to catch memory corruption early. Additionally, monitor for unexpected kernel panics or soft lockups on systems with active passthrough-mode cache devices under heavy concurrent I/O load.

Why prioritize this

This vulnerability merits high priority due to its CVSS 7.8 rating and potential for kernel instability and data corruption in production storage systems. Although it requires local access, the reproducibility and relative ease of triggering concurrent invalidation make it a practical threat in multi-tenant or containerized environments. The combination of memory corruption (use-after-free) and data race conditions could lead to silent data corruption or kernel crashes, both unacceptable outcomes for storage infrastructure.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a locally-exploitable vulnerability with low attack complexity, high impact on confidentiality, integrity, and availability, and no user interaction required. The score appropriately captures the severity: while local access is needed, the ease of reproduction and the critical nature of kernel memory corruption justify the elevated rating. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, but the straightforward reproduction path suggests it could transition to active exploitation if widely disclosed without prior patching.

Frequently asked questions