CVE-2026-53061 Overview
CVE-2026-53061 is a Linux kernel vulnerability in the dm-cache device-mapper target. The flaw allows dirty cache mappings to be loaded into passthrough mode when LVM uses table preload instead of suspend-then-reload. The dirty mapping check executes during table creation, but metadata updates can still occur afterward through the active table. This timing gap permits dirty blocks to enter passthrough mode, where writes bypass the cache, leading to data inconsistency and potential data loss on the origin device.
Critical Impact
Loading dirty cache mappings into passthrough mode can cause silent data loss on storage volumes managed by LVM dm-cache.
Affected Products
- Linux kernel mainline (drivers/md/dm-cache-target.c)
- Linux stable branches containing the dm-cache target
- LVM-managed cache volumes using writeback to passthrough mode transitions
Discovery Timeline
- 2026-06-24 - CVE-2026-53061 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53061
Vulnerability Analysis
The dm-cache device-mapper target supports writeback, writethrough, and passthrough caching modes. Passthrough mode requires a fully clean cache because writes bypass the cache device entirely. To enforce this requirement, the kernel performs a dirty mapping check before allowing a switch to passthrough mode.
The original design assumed that table reloads occur after device suspension, as noted in commit 9b1cc9f251af. Under this assumption, no metadata updates could occur between the dirty check and the activation of the new table. LVM's table preload mechanism violates this assumption by loading the inactive table while the active table continues to service I/O.
The result is a time-of-check to time-of-use [CWE-367] condition. The dirty mapping check passes during table creation, but subsequent writes through the active writeback table dirty additional cache blocks before the preloaded passthrough table is resumed.
Root Cause
The dirty mapping validation logic ran during the ctr (constructor) phase of table loading. This phase completes before the inactive table is swapped in via dmsetup resume. Metadata updates from the active writeback table continued in the interval, invalidating the check result.
Attack Vector
Exploitation requires local privileges to manipulate device-mapper tables, typically root or equivalent capabilities. The reproduction sequence creates a writeback cache with migration_threshold 0 to accumulate dirty blocks, preloads a passthrough table, writes data to dirty the cache, then resumes the inactive table. The race is deterministic rather than probabilistic because the attacker controls the timing of writes between table load and resume.
The fix relocates the dirty mapping check from the constructor phase to the preresume phase, ensuring the check runs immediately before the table becomes active. The unused dm_cache_metadata_all_clean function was also removed.
Detection Methods for CVE-2026-53061
Indicators of Compromise
- Unexpected data corruption or inconsistency on origin devices backing LVM cache volumes
- Kernel logs showing dm-cache mode transitions from writeback to passthrough without prior cache flush
- dmsetup status output reporting non-zero dirty block counts immediately before a passthrough table activation
Detection Strategies
- Audit kernel versions across Linux fleets and compare against the patched commits referenced in the kernel.org advisories
- Monitor dmsetup and LVM operations that perform table reloads on active cache devices
- Inspect storage integrity through filesystem checks on volumes that have undergone cache mode changes
Monitoring Recommendations
- Log all dmsetup reload, dmsetup resume, and lvconvert --cachemode invocations on production hosts
- Alert on cache mode transitions to passthrough when the cache target was previously configured for writeback
- Track kernel package versions through configuration management to confirm patch deployment
How to Mitigate CVE-2026-53061
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the kernel.org commit 322586745bd1 and related stable backports
- Avoid switching LVM cache volumes from writeback to passthrough mode until patched kernels are deployed
- Flush dirty cache blocks explicitly before any cache mode transition by setting an appropriate migration_threshold and waiting for migrations to complete
Patch Information
The fix moves the dirty mapping validation from the table constructor to the preresume callback, ensuring the check reflects metadata state at the moment of activation. Patched commits include 01b22656d8a6, 12105c7f1837, 1443c32f24d6, 21c503d60a25, 322586745bd1, 5c98a3f1d7a5, bd5a2c101893, and c2e86f647561. Distribution kernels should pick up these changes through their stable update channels. Refer to the Linux kernel stable tree for the authoritative source.
Workarounds
- Suspend the cache device with dmsetup suspend before reloading tables to restore the original assumption of the dirty check
- Restrict access to device-mapper administration to trusted operators since the bug requires local privileged operations to trigger
- Use writethrough mode as an interim alternative when consistency between cache and origin is required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
