CVE-2026-89576: Linux Kernel dm-era Information Disclosure

CVE-2026-89576 Overview

CVE-2026-89576 is a resource leak vulnerability in the Linux kernel's dm-era device-mapper target. The flaw resides in metadata_take_snap(), which fails to release a shadowed superblock when subsequent metadata operations fail. Each failed snapshot creation permanently leaks one metadata block from the space map, gradually exhausting metadata space over time.

The issue was resolved through a patch that calls dm_sm_dec_block() on the error paths, mirroring the cleanup already performed by metadata_drop_snap().

Critical Impact
Repeated snapshot creation failures on a dm-era target progressively exhaust metadata space, potentially rendering the device unusable and impacting storage availability.

Affected Products

Linux kernel versions containing the dm-era device-mapper target prior to the fix
Distributions shipping affected stable kernel branches referenced in the upstream commits
Storage stacks and LVM configurations relying on dm-era for tracking block writes

Discovery Timeline

2026-09-11 - CVE-2026-89576 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89576

Vulnerability Analysis

The dm-era target tracks which blocks on a device have been written to during specific eras, supporting rollback and cache coherency workflows. When user space requests a metadata snapshot, metadata_take_snap() increments the live superblock refcount and calls dm_tm_shadow_block() to allocate a new block for the metadata snapshot copy.

The function then invokes dm_sm_inc_block() on writeset_tree_root and era_array_root to pin those structures. If either increment call fails, the original code only unlocked the clone and returned an error. The freshly allocated shadow block was never returned to the metadata space map, resulting in a persistent one-block leak per failed invocation.

Because dm-era metadata space is finite, repeated failures degrade the target over time. This is a classic memory/resource leak on an error path [CWE-401].

Root Cause

The root cause is missing cleanup in the error paths of metadata_take_snap(). Successful shadow block allocation created an accounting obligation, but the failure branches skipped the corresponding dm_sm_dec_block() call. The fix mirrors the release sequence already implemented in metadata_drop_snap(), ensuring symmetric allocation and release semantics.

Attack Vector

Exploitation requires local privileges sufficient to issue device-mapper ioctls against a dm-era target, typically CAP_SYS_ADMIN. An actor able to repeatedly trigger snapshot creation failures could drive metadata space exhaustion, leading to denial of service on the affected volume. The bug is not remotely exploitable and does not directly yield code execution or privilege escalation.

The vulnerability is described in prose only; refer to the upstream commits listed in the references for the exact code changes.

Detection Methods for CVE-2026-89576

Indicators of Compromise

Repeated failures of dmsetup message <era-device> 0 take_metadata_snap operations recorded in system logs
Steadily declining free metadata block counts reported by dm-era status queries without a corresponding increase in active snapshots
Kernel log entries from the device-mapper subsystem referencing dm_sm_inc_block or shadow block errors on dm-era targets

Detection Strategies

Inventory hosts running kernels that predate the fix commits (36ff918, 39c5aa3, 54dd21c, 6876ca3, d66ceeef, dc731d7, e9fa68b, ef00efb) and correlate with dm-era usage
Parse dmsetup status output for dm-era devices to trend metadata free block counts against baseline values over time
Alert when snapshot management tooling logs recurrent take_metadata_snap errors on the same device

Monitoring Recommendations

Ship kernel and device-mapper logs to a centralized platform for retention and correlation across the fleet
Track long-term trends in dm-era metadata utilization to identify slow leaks before they cause outages
Monitor for unexpected privileged invocations of dmsetup and related device-mapper ioctls on production storage nodes

How to Mitigate CVE-2026-89576

Immediate Actions Required

Identify systems using the dm-era target and prioritize patching those with active snapshot workflows
Restrict CAP_SYS_ADMIN and access to device-mapper ioctls to trusted administrative accounts only
Audit automation and monitoring scripts that repeatedly invoke take_metadata_snap and add backoff on failure to limit leak accumulation

Patch Information

The fix adds dm_sm_dec_block() calls on the error paths of metadata_take_snap(), matching the cleanup performed by metadata_drop_snap(). Apply the vendor kernel update corresponding to your distribution. The upstream fixes are available in the following commits:

Workarounds

Avoid repeated take_metadata_snap invocations on error and rebuild dm-era metadata devices with larger metadata reserves where operationally feasible
Limit administrative access to device-mapper interfaces using standard Linux capability controls until patched kernels are deployed
Where possible, unload and recreate affected dm-era targets during maintenance windows to reset leaked metadata accounting