CVE-2026-53063: Linux dm-cache Write Hang in Passthrough Mode – Patch & Detection Guide

Technical summary

CVE-2026-53063 affects the dm-cache (device mapper cache) module in the Linux kernel. The invalidate_remove() function handles write hits that occur after cache invalidation, but its implementation is incomplete: it remaps write bios for submission to the cache origin device but then drops them without actually submitting them to the I/O stack. This causes write operations to stall. The fix introduces a new invalidate_committed() continuation function that properly submits remapped writes after metadata commits complete, leveraging the overwrite_endio hook to maintain correct completion sequencing and preserve cache coherency. Additionally, error handling in invalidate_complete() is corrected to propagate the original error status instead of unconditionally invoking bio_io_error().

Business impact

Systems relying on dm-cache in passthrough mode for caching workloads will experience write hangs during invalidation operations, leading to application stalls and potential data pipeline disruptions. While this requires local access and elevated privileges to exploit, it can affect infrastructure using caching layers for performance optimization, particularly in virtualized or containerized deployments where dm-cache is used for tiered storage. Availability impact is significant; integrity and confidentiality are not directly affected.

Affected systems

This vulnerability affects the Linux kernel across all versions that include the dm-cache subsystem. Specifically, systems running Linux kernels with device mapper cache functionality configured, particularly in passthrough mode, are vulnerable. The issue manifests when cache invalidation is triggered during active write workloads. Both physical and virtual systems using dm-cache for storage optimization are in scope; the requirement for local access and elevated privileges (CAP_SYS_ADMIN or root) narrows the practical attack surface to local threat actors or privileged processes.

Exploitability

Exploitability is limited due to the requirement for local access and elevated privileges. This is not a remote vulnerability and cannot be triggered by unprivileged users. However, for privileged local processes, system administrators, or containers with excessive capabilities, triggering cache invalidation during write-heavy workloads is straightforward. The hang is deterministic once invalidation conditions are met, making it reliable for denial-of-service scenarios in multi-tenant environments or systems with weak privilege separation. No special tools or sophisticated techniques are required; standard cache management operations can trigger the condition.

Remediation

Apply the kernel patch that implements the invalidate_committed() continuation function and corrects error handling in invalidate_complete(). Verify the patch version against the official kernel security advisory or your distribution's update channel. For immediate mitigation in high-risk environments, disable passthrough mode on dm-cache instances if operationally feasible, or limit exposure by restricting access to cache management operations. Kernel upgrades from your Linux distribution should be prioritized; vendors typically backport fixes to supported stable branches.

Patch guidance

Obtain the patched kernel version from your Linux distribution's security updates or directly from kernel.org. Ubuntu, Red Hat, Debian, and other major distributions will release kernel updates addressing this flaw across supported releases. Verify that the update includes the fix to invalidate_remove() logic and the new invalidate_committed() continuation. Testing in a non-production environment before deployment is strongly recommended, particularly if dm-cache is actively caching critical workloads. Monitor for any regression in cache performance post-patch.

Detection guidance

Monitor system logs for evidence of stalled write operations on dm-cache backed devices, particularly if using passthrough mode. Watch for I/O timeouts, hung task warnings, or application-level write timeouts correlated with cache invalidation events. Kernel logs may show blocked or unkillable processes (D state) waiting on device I/O. Check dmesg output for dm-cache related messages around the time of suspected hangs. Network-based detection is not applicable; this requires direct access to affected systems. Correlate cache invalidation commands (dmsetup) with subsequent application performance degradation.

Why prioritize this

While the CVSS score of 5.5 (Medium) reflects the local-only nature of the vulnerability, the practical impact on affected systems can be severe. Any organization using dm-cache in production, particularly in tiered storage or caching acceleration scenarios, should prioritize patching to avoid write stalls that disrupt service availability. The fix is straightforward and unlikely to introduce regression, making this a high-confidence remediation candidate.

Risk score, explained

The CVSS v3.1 score of 5.5 (Medium) reflects an Attack Vector of Local, low Attack Complexity, requirement for Low privilege, no user interaction, impact limited to Availability (High), with no Confidentiality or Integrity impact. The score appropriately downgrades the severity below Critical or High due to privilege and access requirements, but the High Availability impact reflects the serious nature of write hangs in production systems.

Frequently asked questions