CVE-2026-53062 Overview
CVE-2026-53062 is a race condition in the Linux kernel device-mapper (dm) cache target, specifically in the Stochastic Multi-Queue (smq) cache policy. When a dm-cache device operates in passthrough mode, the invalidate_mapping operation can be invoked concurrently from multiple worker threads without proper locking. The unsynchronized access produces data races on the allocated blocks counter and may lead to use-after-free conditions in internal smq data structures during concurrent writes.
Critical Impact
Concurrent invocation of smq_invalidate_mapping() in passthrough mode can corrupt cache accounting and trigger use-after-free conditions in kernel memory, risking kernel instability or memory safety violations.
Affected Products
- Linux kernel device-mapper subsystem (drivers/md/dm-cache-policy-smq.c)
- dm-cache targets configured with the smq policy in passthrough mode
- Stable kernel branches receiving the backported fixes referenced in the kernel.org commits
Discovery Timeline
- 2026-06-24 - CVE-2026-53062 published to the National Vulnerability Database (NVD)
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53062
Vulnerability Analysis
The Linux kernel dm-cache target uses the smq policy to manage cache block placement, promotion, and demotion. In passthrough mode, all writes bypass the cache and any block currently cached must be invalidated to maintain coherency. The invalidation path calls smq_invalidate_mapping(), which mutates shared policy state including the allocated blocks counter and internal queue structures.
Writeback and write-through modes serialize these mutations through the migration worker. Passthrough mode has no migration tasks, so multiple I/O workers can enter invalidate_mapping simultaneously. The function was authored under the assumption of single-threaded execution and contains no internal locking. Concurrent execution produces interleaved updates to the allocated counter and can dereference freed entries in the smq internal data structures.
Root Cause
The root cause is a missing lock around the invalidate_mapping policy operation in passthrough mode. The smq policy assumes serialization by the higher-level migration framework, but that framework is inactive when the cache is loaded in passthrough mode. This is a classic race condition [CWE-362] that can escalate to use-after-free [CWE-416] under concurrent write workloads.
Attack Vector
Exploitation requires local access with the ability to issue write I/O to a dm-cache device configured with the smq policy in passthrough mode. The reproducer published with the patch creates a cache device, populates it, reloads it into passthrough mode, then issues concurrent writes via fio with multiple jobs at the cache block size. The demoted block count diverges from the cached block count, exposing the data race. Under heavier contention, the freed-block code paths can be exercised, producing potential kernel memory corruption.
No verified public exploit code is available. The reproducer described in the upstream commit message demonstrates the race using standard dmsetup and fio commands.
Detection Methods for CVE-2026-53062
Indicators of Compromise
- Kernel oops or panic messages referencing smq_invalidate_mapping, dm-cache, or smq queue internals in dmesg and /var/log/kern.log
- Mismatch between the cached block count (column 7) and demoted block count (column 12) in dmsetup status cache output after passthrough write workloads
- KASAN reports flagging use-after-free in dm-cache-policy-smq on kernels built with memory sanitizers
Detection Strategies
- Inventory hosts running dm-cache targets and identify any cache device reloaded into passthrough mode via dmsetup table | grep cache
- Correlate kernel version data from endpoint telemetry against the fixed commits to identify unpatched systems
- Monitor for unexpected kernel crashes on storage-heavy hosts and capture crash dumps for analysis of the smq call stack
Monitoring Recommendations
- Ingest dmesg and kernel crash data into a centralized logging or SIEM pipeline and alert on stack traces containing dm-cache-policy-smq symbols
- Track uname -r and package versions across the Linux fleet to confirm patched kernels are deployed
- Audit storage management workflows that issue dmsetup reload ... passthrough to ensure they target patched hosts only
How to Mitigate CVE-2026-53062
Immediate Actions Required
- Apply the upstream kernel patches referenced in the Kernel Git Commit Fix and related stable backports
- Update to a distribution kernel that includes the smq locking fix once vendor advisories publish fixed builds
- Avoid reloading active dm-cache devices into passthrough mode on unpatched kernels under concurrent write workloads
Patch Information
The fix adds a lock around the invalidate_mapping operation in the smq policy so that concurrent invocations in passthrough mode are serialized. Patched commits are available across multiple stable branches, including 1b2bec4a7dcf, 2b62d0611c9a, 2d1f7b65f5de, 4991b5a08751, 93627a29d4b6, 9a5fdfb9e57e, ac5ee9944389, and c348ae47d8e6.
Workarounds
- Operate dm-cache devices in writethrough or writeback mode until patched kernels are deployed, since migration-task serialization covers the affected path in those modes
- Restrict concurrent write workloads against any dm-cache device currently in passthrough mode by limiting numjobs or queue depth at the application layer
- Limit local user access to block devices and dmsetup operations through standard Linux access controls and sudoers policy review
# Verify running kernel and confirm dm-cache mode before exposing workloads
uname -r
dmsetup table | awk '/cache/ {print}'
# Inspect cached vs. demoted block counts to detect divergence after writes
dmsetup status cache | awk '{print "cached="$7" demoted="$12}'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
