CVE-2026-53265: Linux Kernel dm-cache SMQ Race Condition

Technical summary

CVE-2026-53265 is a check-then-act race condition in dm_cache_policy_smq.c's smq_invalidate_mapping() function. The e->allocated predicate check occurs outside the mq->lock critical section, allowing concurrent invalidators to observe the same allocated entry before either acquires the lock. After the first invalidator removes the entry from queues and hash tables and calls free_entry() (which clears e->allocated), the second invalidator proceeds with outdated state, leading to deletion of entries no longer in their structures or double-free conditions that trigger allocation checks in free_entry(). The fix moves the allocation check into the mq->lock critical section, serializing the predicate with destructive operations.

Business impact

Exploitation can result in kernel memory corruption, denial of service through crash or hang, or privilege escalation via heap manipulation. Systems with DMCache enabled and handling concurrent cache invalidation workloads (common in high-I/O environments like databases, caching layers, and storage appliances) face elevated risk. Impact severity depends on system role and cache pressure patterns.

Affected systems

Linux kernel versions containing the incomplete fix from commit 2d1f7b65f5de are affected. Specifically, kernel versions from that commit through the one containing the full fix are vulnerable. Systems with dm-cache configured and active must patch. Verify your exact kernel version against the Linux kernel security advisory and your distribution's patch status.

Exploitability

Exploitation requires local system access and unprivileged user capability. No special privileges are needed to trigger concurrent cache block invalidations. The vulnerability is not network-exploitable; it requires an attacker with shell access or a local service with cache access permissions. Successful exploitation is probabilistic—the race window is narrow but reproducible under contention.

Remediation

Apply the kernel patch that relocates the e->allocated check into the mq->lock critical section. Affected distributions and custom kernel maintainers must backport or update to a patched version. Immediate patching is recommended for production systems using dm-cache, particularly those under high I/O concurrency.

Patch guidance

Consult your Linux distribution's security advisory for the specific patched kernel version (e.g., RHEL, Ubuntu, Debian, SUSE, etc.). For custom or upstream kernels, apply the fix upstream or backport the patch from the Linux kernel repository. Verify the patch includes moving the e->allocated check inside the mq->lock region. Test in a staging environment before production deployment, particularly on systems with high cache invalidation activity.

Detection guidance

Monitor kernel logs for use-after-free or double-free warnings from dm-cache subsystem. Look for BUG_ON messages in free_entry(). Kernel Address Sanitizer (KASAN) and CONFIG_DEBUG_PAGEALLOC will flag corruption. Correlation of cache invalidation storms with system instability or crashes may indicate exploitation attempts. Check /proc/modules for dm_cache module presence; if absent, the system is not vulnerable via this vector.

Why prioritize this

HIGH severity with local privilege escalation and data corruption potential. Affects production infrastructure, particularly high-throughput storage and caching systems. The race condition is reproducible under cache pressure and impacts system stability and data integrity. Local access requirement limits external attack surface but does not eliminate internal threat vectors.

Risk score, explained

CVSS 3.1 score 7.8 (HIGH) reflects local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality, integrity, and availability impact (C:H/I:H/A:H). The combination of memory corruption, denial of service, and potential privilege escalation justifies the high rating despite requiring local access.

Frequently asked questions