CVE-2026-53063: Linux Kernel dm-cache DoS Vulnerability

CVE-2026-53063 Overview

CVE-2026-53063 is a Linux kernel vulnerability in the device-mapper (dm) cache target. The invalidate_remove() function contains incomplete logic for handling write hit bios after cache invalidation when the cache operates in passthrough mode. The function sets up remapping for the overwrite_bio but drops it without submission, causing write operations to hang indefinitely.

The issue has been resolved upstream by introducing an invalidate_committed() continuation that submits remapped writes to the cache origin after metadata commit completes. Error handling in invalidate_complete() was also improved to preserve original error status instead of unconditionally calling bio_io_error().

Critical Impact
Write I/O operations to dm cache devices in passthrough mode can hang following cache invalidation, leading to denial of service on storage subsystems backed by device-mapper cache.

Affected Products

Linux kernel versions containing the dm cache target with the unpatched invalidate_remove() logic
Systems using device-mapper cache configured in passthrough mode
Distributions shipping affected stable kernel branches referenced in the upstream commits

Discovery Timeline

2026-06-24 - CVE-2026-53063 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53063

Vulnerability Analysis

The Linux device-mapper cache target supports a passthrough mode where writes bypass the cache and go directly to the origin device, while reads can still be served from the cache when blocks are clean. When a write hits a cached block in passthrough mode, the cache must invalidate that block to maintain coherency before allowing the write to proceed.

The invalidate_remove() function handles this invalidation flow. The defective logic prepared an overwrite_bio for remapping to the origin device but then released the bio without ever submitting it to the underlying block layer. The write operation never completed, causing the issuing thread to block indefinitely waiting on I/O completion.

This is a denial-of-service condition affecting storage availability. It does not provide a path to code execution or memory corruption.

Root Cause

The root cause is a missing continuation step in the cache invalidation state machine. After metadata commit, the remapped write bio must be explicitly submitted, but the original code released it. Additionally, invalidate_complete() overwrote the actual bio status with a generic I/O error, masking the true completion state.

Attack Vector

Exploitation requires local access to write to a dm cache device configured in passthrough mode. There is no remote attack vector. Triggering the hang requires inducing a write hit on a cached block, which any process with write permission to the device can do during normal I/O. There is no indication this vulnerability is exploited in the wild.

No public proof-of-concept code is available. The fix is described in the upstream Linux kernel commits referenced below.

Detection Methods for CVE-2026-53063

Indicators of Compromise

Processes stuck in uninterruptible sleep (D state) performing I/O against a dm cache device in passthrough mode
hung_task kernel warnings naming threads blocked in dm cache write paths
Storage workloads on cache-backed volumes failing to make forward progress without disk errors being reported

Detection Strategies

Inspect /proc/<pid>/stack for processes blocked in dm cache bio submission paths
Query the running kernel version against patched stable releases referenced in the upstream commits
Audit logical volume configurations with dmsetup table to identify caches operating in passthrough mode

Monitoring Recommendations

Enable kernel.hung_task_timeout_secs and forward hung_task warnings to a centralized log pipeline
Track I/O latency and queue depth metrics on dm cache devices to surface stalled writes early
Alert on kernel ring buffer messages from the dm-cache subsystem indicating invalidation or commit anomalies

How to Mitigate CVE-2026-53063

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits, then reboot affected hosts
Inventory all dm cache deployments and identify volumes configured in passthrough mode
Coordinate with your Linux distribution vendor to obtain a backported kernel build for the affected stable branch

Patch Information

The fix is available in the following upstream Linux kernel commits:

The patches introduce the invalidate_committed() continuation, wire the overwrite_endio hook for completion sequencing, and preserve original error status in invalidate_complete().

Workarounds

Switch dm cache devices from passthrough mode to writethrough or writeback mode where operationally acceptable, since the defective code path is specific to passthrough handling
Detach the cache from origin volumes on affected hosts until a patched kernel is deployed, falling back to direct I/O against the origin device
Avoid workloads that produce frequent write hits on cached blocks on unpatched systems