CVE-2026-53059: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53059 Overview

CVE-2026-53059 is an out-of-bounds write vulnerability in the Linux kernel's device-mapper (dm) log subsystem. The flaw resides in the create_log_context() function, where the local variable region_count is declared as a 32-bit unsigned int while dm_sector_div_up() returns a 64-bit sector_t. When a device-mapper target uses a sufficiently large ti->len with a small region_size, the division result exceeds UINT_MAX and is silently truncated.

Critical Impact
The truncated region count causes clean_bits, sync_bits, and recovering_bits bitsets to be allocated far smaller than required, enabling out-of-bounds writes into kernel heap memory allocated by vmalloc and triggering kernel crashes.

Affected Products

Linux kernel (device-mapper log module dm_log)
Distributions shipping kernels prior to the fixes referenced in the kernel.org stable commits
Systems using mirror targets created via dmsetup with large logical sizes

Discovery Timeline

2026-06-24 - CVE-2026-53059 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53059

Vulnerability Analysis

The vulnerability is an integer truncation defect in the dm_log kernel module. In create_log_context(), the result of dm_sector_div_up() (a 64-bit sector_t value) is assigned into a 32-bit unsigned int local named region_count. When the computed region count exceeds 0xFFFFFFFF, the upper bits are discarded.

The truncated value is then used to compute bitset_size, which determines the size of the clean_bits, sync_bits, and recovering_bits allocations. Subsequent log operations including log_set_bit, log_clear_bit, and log_test_bit index those bitsets using region indices derived from the full untruncated region space. The mismatch produces out-of-bounds writes into adjacent vmalloc kernel heap memory.

Root Cause

The root cause is a numeric truncation error [CWE-197 / CWE-787 class]. The narrower 32-bit local cannot represent the full range produced by the 64-bit division helper. The reproducer creates a mirror target where region_count should equal 4294967297 (0x100000001) but the truncated value stored is 1, as confirmed by dmsetup status output showing 1/4294967297 instead of the correct sync count.

Attack Vector

Exploitation requires the ability to create device-mapper targets, which is normally restricted to privileged users holding CAP_SYS_ADMIN. A local actor with such privileges can construct a mirror target whose size and region_size parameters force the overflow. The proof-of-concept uses two dmsetup create invocations: one to instantiate a large zero device of 8589934594 sectors, and a second to layer a mirror target over it. Once log operations execute against the undersized bitsets, the kernel writes past the allocation boundary, producing a panic such as BUG: scheduling while atomic and a fault in core_in_sync+0x14/0x30 [dm_log]. The impact is denial of service through kernel crash, with potential for further memory corruption depending on neighboring vmalloc allocations.

The vulnerability is described in prose because verified exploit code beyond the reproducer in the kernel commit message is not available. See the kernel.org stable commit for the upstream fix and reproducer.

Detection Methods for CVE-2026-53059

Indicators of Compromise

Kernel oops or panic messages referencing core_in_sync+0x14/0x30 [dm_log] in dmesg or /var/log/kern.log
BUG: scheduling while atomic entries correlated with device-mapper or udev-worker processes
dmsetup status output where the sync count denominator is unexpectedly small relative to the target size (for example 1/4294967297)

Detection Strategies

Audit kernel versions across the fleet and flag hosts running dm_log builds that predate the stable commits listed in the NVD references
Monitor for unexpected invocations of dmsetup create with mirror targets, particularly with ti->len values exceeding 0xFFFFFFFF * region_size
Alert on kernel crash signatures involving the dm_log module across the endpoint estate

Monitoring Recommendations

Forward kernel logs and auditd records for dmsetup and ioctl activity to a centralized SIEM for correlation
Track creation of new device-mapper devices and changes to existing mirror tables as privileged administrative events
Establish a baseline of expected device-mapper usage on storage and virtualization hosts so anomalous targets stand out

How to Mitigate CVE-2026-53059

Immediate Actions Required

Apply vendor kernel updates that include the upstream dm log fix as soon as they are available for your distribution
Restrict CAP_SYS_ADMIN and access to /dev/mapper/control to trusted administrative accounts only
Review existing device-mapper mirror configurations for unusually large logical sizes paired with small region sizes

Patch Information

The upstream fix widens the local region_count to sector_t and adds an explicit overflow check before assigning the value to lc->region_count. Patches are available across multiple stable branches via the kernel.org references, including commit 44ab8875, commit 12bd5b88, commit 3ec74da9, commit 4ec8323b, commit b455903e, commit c20e36b7, commit d4ac8756, and commit defe483e. Rebuild distribution kernels or install vendor-supplied updates that incorporate these commits.

Workarounds

Avoid creating device-mapper mirror targets where ti->len / region_size can exceed UINT_MAX until a patched kernel is deployed
Where the dm_log module is not required, prevent it from loading by adding it to the kernel module blacklist
Enforce least-privilege policies so non-administrative users cannot invoke dmsetup

bash

# Configuration example: block dm_log from loading on hosts that do not need it
echo 'install dm_log /bin/true' | sudo tee /etc/modprobe.d/blacklist-dm_log.conf
sudo update-initramfs -u
# Verify the running kernel after patching
uname -r