CVE-2026-53064: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53064 Overview

CVE-2026-53064 is a null pointer dereference vulnerability in the Linux kernel's dm-cache device-mapper target. The flaw occurs in passthrough mode when dm-cache attempts to invalidate a cache entry and the bio prison cell lock fails because of a concurrent write to the same cached block. In that state, mg->cell remains NULL, and the error path in invalidate_complete() unconditionally unlocks and frees the cell, triggering a kernel null pointer dereference detected by KASAN. The issue is reachable by any local workload that issues concurrent writes against a dm-cache device configured in passthrough mode.

Critical Impact
Local users with I/O access to a dm-cache device in passthrough mode can trigger a kernel null pointer dereference, resulting in denial of service of the affected host.

Affected Products

Linux kernel dm-cache (device-mapper cache target)
Linux kernel builds prior to the fixes referenced in the stable git commits
Distributions shipping vulnerable mainline and stable kernels using CONFIG_DM_CACHE

Discovery Timeline

2026-06-24 - CVE-2026-53064 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53064

Vulnerability Analysis

The vulnerability resides in the dm-cache target inside drivers/md/dm-cache-target.c. In passthrough mode, dm-cache routes writes directly to the origin device and invalidates any matching cache block. The invalidation path allocates a migration structure (mg) and attempts to acquire a bio prison v2 cell lock on the cache block to serialize access. When two writes target the same cached block concurrently, the cell lock acquisition can fail before mg->cell is assigned, leaving it as NULL.

The error path in invalidate_complete() then calls dm_cell_unlock_v2() and frees the cell without verifying that mg->cell was actually populated. Dereferencing the null cell pointer faults inside dm_cell_unlock_v2+0x3f/0x210, with the call chain invalidate_complete -> map_bio -> cache_map -> __map_bio -> dm_submit_bio. KASAN reports a null-ptr-deref in the range [0x0000000000000000-0x0000000000000007]. The fix validates mg->cell before any unlock or free operation.

Root Cause

The root cause is a missing null check on the mg->cell field along the failure path of cache invalidation in passthrough mode. The migration structure is partially initialized before cell lock acquisition, and the cleanup logic assumes successful allocation, classifying the defect as a Null Pointer Dereference [CWE-476] in the kernel device-mapper subsystem.

Attack Vector

An attacker requires local access and the ability to issue I/O against a dm-cache device configured in passthrough mode. Concurrent direct writes against the same cached block reliably reproduce the fault. The publicly documented reproducer uses dmsetup to construct cache metadata, data, and origin devices, promotes a block via fio, reloads the cache table in passthrough mode, then runs two parallel fio random write jobs targeting the same 4 KiB block. The resulting kernel oops yields a denial of service on the affected host.

No verified exploit code is published beyond the reproduction steps included in the upstream commit message. See the upstream fix commit for technical details.

Detection Methods for CVE-2026-53064

Indicators of Compromise

Kernel oops or panic referencing dm_cell_unlock_v2, invalidate_complete, cache_map, or dm_submit_bio in the call trace.
KASAN reports of null-ptr-deref in range [0x0000000000000000-0x0000000000000007] originating from the dm-cache target.
Unexpected reboots or I/O stalls on hosts running dm-cache devices in passthrough mode under concurrent write workloads.

Detection Strategies

Inventory hosts with CONFIG_DM_CACHE enabled and identify any active dm-cache tables in passthrough mode using dmsetup table | grep cache.
Correlate kernel logs (dmesg, journalctl -k) for stack traces matching the invalidate_complete -> dm_cell_unlock_v2 pattern.
Track installed kernel versions against the fixed commits listed in the upstream stable tree to flag vulnerable builds.

Monitoring Recommendations

Forward kernel ring buffer and kdump crash artifacts to a central log platform for retroactive search of the affected call trace.
Alert on repeated dm-cache related kernel warnings or oopses on storage and virtualization hosts.
Monitor reboot frequency and I/O error rates on systems using device-mapper cache targets.

How to Mitigate CVE-2026-53064

Immediate Actions Required

Apply the upstream Linux kernel patch series referenced in the stable git commits as soon as vendor builds are available.
Identify all production hosts using dm-cache and confirm whether any are configured in passthrough mode.
Restrict local and container access to dm-cache-backed block devices on unpatched systems to limit who can trigger concurrent writes.

Patch Information

The defect is resolved by adding a null check on mg->cell before attempting to unlock or free the bio prison cell in the invalidation error path. Fixes are available in the upstream stable tree in commits 01264a6a, 0aa745fe, 25dcc198, 7d1f98d6, a2635d54, c7fb6bc8, df3b8ef0, and ee38fb00. Rebuild or update to a distribution kernel that incorporates these commits.

Workarounds

Switch affected dm-cache devices away from passthrough mode to writethrough or writeback until the patched kernel is deployed.
Avoid issuing concurrent direct writes to the same cached block on dm-cache devices in passthrough mode.
Where feasible, suspend and remove dm-cache layering on hosts that cannot be patched promptly.

bash

# Reload an existing dm-cache table out of passthrough mode as a temporary workaround
dmsetup suspend cache
dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \
  /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
dmsetup resume cache