CVE-2026-89997: Linux Kernel Race Condition Vulnerability

CVE-2026-89997 Overview

CVE-2026-89997 is a race condition in the Linux kernel's device mapper (dm) subsystem. When a user issues the resume ioctl and the remove ioctl concurrently, the device may be resumed after it was already suspended in __dm_destroy. The table is then destroyed without invoking the postsuspend method, violating an invariant that dm targets rely on. In the dm-integrity target, the reboot notifier is not unregistered, producing a use-after-free condition.

Critical Impact
A local attacker with permission to issue device mapper ioctls can trigger a use-after-free in kernel memory, enabling privilege escalation, denial of service, or kernel memory corruption.

Affected Products

Linux kernel (device mapper subsystem)
dm-integrity target (confirmed use-after-free path)
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-09-16 - CVE-2026-89997 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-89997

Vulnerability Analysis

The device mapper subsystem exposes ioctl operations for controlling mapped devices, including suspend, resume, and remove. The kernel assumes a strict ordering where a target's postsuspend handler runs before the target is torn down. This ordering is broken when resume and remove are issued in parallel from user space.

Inside __dm_destroy, the device is suspended as part of the teardown sequence. If a concurrent resume ioctl wins the race, it resumes the device after the destroy path has already suspended it. The destroy path then proceeds to free the table without ever running postsuspend. Targets that register long-lived resources during setup expect postsuspend to release those resources.

In the case of dm-integrity, the reboot notifier registered by the target is never unregistered. After the target structure is freed, the notifier chain still references the freed memory. A subsequent reboot event, or any traversal of the notifier chain, dereferences memory that has been returned to the allocator.

Root Cause

The root cause is missing synchronization between the resume and remove ioctl handlers in drivers/md/dm.c. The remove path suspends the device and destroys the table, but the resume path does not check whether the device is currently being destroyed. This is a classic time-of-check to time-of-use pattern that allows the state machine to violate its own preconditions.

Attack Vector

Exploitation requires local access with the capability to issue device mapper ioctls, typically CAP_SYS_ADMIN or equivalent access to /dev/mapper/control. An attacker races the DM_DEV_SUSPEND_CMD (resume) ioctl against DM_DEV_REMOVE_CMD on the same device. Winning the race with a target such as dm-integrity produces a dangling notifier chain entry pointing at freed memory, which can later be triggered to corrupt kernel state.

The upstream fix, applied across multiple stable branches in commits 1ede2bc, 36177be, 3b59530, 3f04e65, 44b43ec, 94380ec, 94f3d39, and 9757367, refuses to resume a device that is being destroyed.

Detection Methods for CVE-2026-89997

Indicators of Compromise

Kernel oops or panic messages referencing dm-integrity, notifier chain traversal, or __dm_destroy in the stack trace
KASAN reports flagging use-after-free within the device mapper subsystem
Unexpected process termination or system instability shortly after concurrent device mapper administrative operations

Detection Strategies

Monitor kernel logs for warnings originating from drivers/md/dm.c and drivers/md/dm-integrity.c
Enable KASAN on test systems to surface use-after-free access patterns during device mapper stress testing
Audit processes invoking DM_DEV_SUSPEND_CMD and DM_DEV_REMOVE_CMD ioctls in rapid succession against the same device

Monitoring Recommendations

Track running kernel versions across the fleet and flag hosts that lack the fix commits listed in the upstream references
Alert on unexpected use of the dmsetup binary by non-administrative accounts or automated tooling
Collect /dev/mapper/control open events through kernel auditing to identify processes exercising device mapper ioctls

How to Mitigate CVE-2026-89997

Immediate Actions Required

Apply the latest stable kernel release for your distribution that includes the referenced fix commits
Restrict access to /dev/mapper/control and the dmsetup tool to trusted administrators only
Review container and virtualization workloads that grant CAP_SYS_ADMIN, since these can reach the vulnerable ioctl surface

Patch Information

The fix has been merged into the mainline and multiple stable branches. Refer to the upstream commits 1ede2bc, 36177be, 3b59530, 3f04e65, 44b43ec, 94380ec, 94f3d39, and 9757367. The patch makes the resume ioctl refuse to proceed when the device is being destroyed.

Workarounds

Avoid concurrent invocation of resume and remove operations against the same mapped device in automation and orchestration tooling
Where dm-integrity is not required, unload the module with modprobe -r dm_integrity to remove the exploitable notifier registration path
Constrain workloads that must run with CAP_SYS_ADMIN behind mandatory access control policies such as SELinux or AppArmor

bash

# Verify the running kernel and installed device mapper tooling
uname -r
dmsetup --version

# Restrict dmsetup execution to the root group
chown root:root /usr/sbin/dmsetup
chmod 0750 /usr/sbin/dmsetup

# Remove dm-integrity if unused in your environment
lsmod | grep dm_integrity && modprobe -r dm_integrity