Look up another CVE · open CVE-2026-53265 in the interactive tracker
CVE-2026-53265
dm cache policy smq: check allocation under invalidate lock
Published 2026-06-25 (4 months ago) by the Linux kernel CNA. Subsystem drivers/md. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-53265 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
commit 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks") added mq->lock around the destructive part of smq_invalidate_mapping(), but left the e->allocated check outside the critical section. That leaves a check-then-act race. Two concurrent invalidators can both observe e->allocated as true before either of them takes mq->lock. The first invalidator that acquires the lock removes the entry from the queues and hash table and then calls free_entry(), which clears e->allocated and puts the entry back on the free list. The second invalidator can then acquire mq->lock and continue with the stale result of the unlocked check. This can corrupt the SMQ queues or hash table by deleting an entry that is no longer on those structures. It can also hit the allocation check in free_entry() when the same entry is freed again. Move the allocation check under mq->lock so the predicate and the destructive operations are serialized by the same lock.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/md/dm-cache-policy-smq.c
- What this is
- DEVICE-MAPPER (LVM)MAINTAINERS section matched on drivers/md/dm* · dm-devel@lists.linux.dev · Maintained
- Kernel module
- dm_cache_smq
Check it on the machine
grep -wE 'CONFIG_DM_CACHE_SMQ|CONFIG_MD' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w dm_cache_smqPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_DM_CACHE_SMQ, CONFIG_MD
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-25 (4 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.12%, higher than 1.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/md
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.10.258 | 5.10.259 | c242c7af2aec |
| 5.15.209 | 5.15.210 | 13da856c86fb |
| 6.1.175 | 6.1.176 | d886945fcb0f |
| 6.6.141 | 6.6.143 | b4892561552d |
| 6.12.91 | 6.12.94 | 03ffe1112ed8 |
| 6.18.33 | 6.18.36 | 42ff6774ecd9 |
| 7.0.10 | 7.0.13 | c57570fba240 |
| 7.1 | 7.1 | d3f0a606b9f2 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable code is reached locally through device-mapper cache invalidation, via DM target messages or writes to an already configured passthrough dm-cache device. There is no network, adjacent, or physical packet/device path.
- AC:LAttack complexity, low
- The race is between concurrent invalidators, and an attacker who can issue concurrent writes or invalidation requests can create that concurrency. When uncertain, the attacker-controlled race is scored as low complexity.
- PR:LPrivileges required, low
- DM control ioctls require init-namespace CAP_SYS_ADMIN, but a plausible deployment lets a low-privileged local user generate passthrough cache writes through a mounted or otherwise writable dm-cache-backed device. User namespaces do not bypass the DM ioctl gate.
- UI:NUser interaction, none
- No victim action is required after the vulnerable dm-cache device is present; the attacker triggers invalidation with local I/O or messages. The race does not depend on another user opening a file or approving an action.
- S:UScope, unchanged
- The impact remains within the same kernel/storage security authority. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.
- C:HConfidentiality impact, high
- The stale invalidation can corrupt SMQ queue/hash policy state, potentially misdirecting cached block mappings and exposing data from other blocks. As kernel memory/data-structure corruption, confidentiality impact is scored high when uncertain.
- I:HIntegrity impact, high
- The bug can delete/free an entry twice and corrupt SMQ queues or hash tables before hitting the allocation check. That can corrupt cache mapping state and kernel data structures, so integrity impact is high.
- A:HAvailability impact, high
- The second free can hit BUG_ON(!e->allocated), causing a kernel oops/panic. Even without the BUG_ON path, corrupted cache policy structures can destabilize the kernel, so availability impact is high.