dm cache policy smq: fix missing locks in invalidating cache blocks
In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should be protected by a lock. Otherwise, we might end up with data races on the allocated blocks counter, or even use-after-free issues with internal data structures when doing concurrent writes. Note that the existing FIXME in smq_invalidate_mapping() doesn't affect passthrough mode since migration tasks don't exist there, but would need attention if supporting fast device shrinking via suspend/resume without target reloading. Reproduce steps: 1. Create a cache device consisting of 1024 cache entries dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Populate the cache, and record the number of cached blocks fio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k \ --size=64m --direct=1 nr_cached=$(dmsetup status cache | awk '{split($7, a, "/"); print a[1]}') 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta
CVE-2026-53062
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-53062
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"lessThan": "4991b5a08751e2e82488fb93ae08849b6aea10d9",
"versionType": "git"
},
{
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"lessThan": "1b2bec4a7dcf5f00b7a1cbeeec8997841d783513",
"versionType": "git"
},
{
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"lessThan": "9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e",
"versionType": "git"
},
{
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"lessThan": "ac5ee99443891bdb161f5539606a66a1b5e72542",
"versionType": "git"
},
{
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"lessThan": "93627a29d4b66d4a2def938dfb8610cc80ae454b",
"versionType": "git"
},
{
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"lessThan": "c348ae47d8e65f06429fa41adce9ad986b696766",
"versionType": "git"
},
{
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"lessThan": "2b62d0611c9af14a16bddf22df2612b4f40eb5a1",
"versionType": "git"
},
{
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"lessThan": "2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45",
"versionType": "git"
}
],
"programFiles": [
"drivers/md/dm-cache-policy-smq.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/md/dm-cache-policy-smq.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-53062
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40738 · Revision 1
- Added to Heist Feed
- Publisher date