CVE-2026-53064: Linux dm-cache Null Pointer Dereference DoS Vulnerability

Technical summary

The vulnerability exists in the dm-cache invalidation path when operating in passthrough mode. During cache entry invalidation, if the bio prison cell lock acquisition fails due to concurrent writes to the same block, the mg->cell pointer remains uninitialized (NULL). The error-handling path in invalidate_complete() unconditionally attempts to unlock and free this cell via dm_cell_unlock_v2(), triggering a null pointer dereference. The issue is caused by insufficient null-pointer validation before the unlock operation. The fix involves checking the validity of mg->cell before attempting to unlock it in the error path.

Business impact

This vulnerability can be exploited by local users to crash the Linux kernel, causing system downtime and service interruption. Organizations running dm-cache in passthrough mode with workloads involving concurrent writes to the same cached blocks face increased risk of unexpected system failures. This is particularly relevant for storage administrators using Linux device mapper for cache tiering or hybrid storage configurations.

Affected systems

The Linux kernel is affected. The vulnerability occurs specifically in passthrough mode of the dm-cache subsystem, which is part of the Linux device mapper infrastructure. Affected systems include any Linux distribution running a vulnerable kernel version where dm-cache is compiled and in use. The issue requires local system access and relies on specific I/O patterns to trigger.

Exploitability

Exploitability requires local system access (privilege level: local user) with the ability to issue direct I/O operations to a dm-cache device configured in passthrough mode. The vulnerability is triggered by concurrent writes to the same cached block, which can be reliably reproduced using standard Linux I/O tools like fio. No special authentication or complex conditions are required beyond the ability to write to the cache device. An attacker with local access can reliably crash the system.

Remediation

The fix involves adding a null-pointer check for mg->cell before calling dm_cell_unlock_v2() in the invalidate_complete() error path. This ensures that unlock operations only proceed on valid cell pointers. Verify the availability of patched kernel versions from your Linux distribution vendor and apply updates through your standard kernel patching process. Test the patch in a non-production environment before rolling out to production systems running dm-cache.

Patch guidance

Apply the latest kernel update from your Linux distribution vendor that includes the fix for CVE-2026-53064. The patch should add a validity check before the dm_cell_unlock_v2() call in the invalidate_complete() function within the dm-cache code. Verify against your vendor's advisory for specific kernel versions and release notes confirming the fix. On most distributions, this will be available through standard package management (apt, yum, etc.). Reboot systems after applying the patch to ensure the updated kernel is in use.

Detection guidance

Monitor system logs for kernel panic messages containing 'null-ptr-deref' and stack traces referencing dm_cell_unlock_v2() or invalidate_complete(). KASAN (Kernel Address Sanitizer) builds will report null pointer dereferences in this code path. Use syslog monitoring tools to detect unexpected kernel crashes on systems running dm-cache. Workload profiling tools can identify I/O patterns involving concurrent writes to the same cache blocks, which are necessary to trigger this vulnerability. Check kernel version and verify whether dm-cache is loaded and in use via /proc/modules or modprobe.

Why prioritize this

This vulnerability merits timely remediation due to its ease of exploitation for local denial-of-service attacks. While the CVSS score of 5.5 reflects medium severity (local-only access, no data compromise), the simplicity of triggering the crash and the potential for coordinated repeated attacks make it a reliability risk. Organizations using dm-cache in passthrough mode should prioritize patching to maintain system stability and availability. The vulnerability is not presently on the CISA KEV catalog, but this does not diminish the importance of remediation for affected workloads.

Risk score, explained

CVE-2026-53064 receives a CVSS v3.1 score of 5.5 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. This reflects: local attack vector (AV:L) limiting exposure to authenticated local users; low attack complexity (AC:L) as concurrent I/O is easily reproducible; low privilege requirement (PR:L) requiring basic system access; no user interaction (UI:N); single security domain impact (S:U); and high availability impact (A:H) from kernel crash. The score appropriately captures the high availability risk balanced against the local-only attack surface.

Frequently asked questions