{"id":"CVE-2026-99036","kind":"vulnerability","aliases":["CVE-2026-99036"],"related":[],"title":"Linux kernel device-mapper: race reads freed memory during table resume","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix reading free memory in do_resume\n\nWhen do_resume calls dm_table_get_mode(new_map), the call is done without\nholding any locks (it only holds a reference to the md). It may be\npossible that another concurrent ioctl on the same device will swap table\nafter dm_swap_table and before dm_table_get_mode. In this case,\ndm_table_get_mode(new_map) reads freed memory.\n\nThis race condition was triggered by syzbot.\n\nThis commit fixes the race by reading mode of the new table before\ndm_swap_table. Note that new_map is also passed to dm_ima_need_measure,\nbut this function doesn't attempt to dereference it, so this call should\nbe safe.\n\nNote that this is not a security bug because only root can trigger it and\nthe commonly used tools such as lvm or cryptsetup do not call the ioctls\nconcurrently, so that they can't trigger it acceidentally.","summary":"A race in the Linux kernel device-mapper resume path can read freed memory when two ioctls on the same device swap tables concurrently. The sources say only root can trigger it and that the kernel maintainers do not consider it a security bug.","severity":"low","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dm-crypt","infrastructure","kernel","linux","lvm"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"- `uname -r` to see the running kernel version\n- unknown for whether the running kernel contains the fix","fix":"- Update to a Linux kernel build that includes the upstream commit fixing the do_resume race in dm (version unknown)","status":"open","published_at":"2026-10-23T13:17:26+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:17+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:54:17Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel build that includes the upstream commit fixing the do_resume race in dm (version unknown)","reach":"local","title":"Linux kernel device-mapper: race reads freed memory during table resume","impact":"low","summary":"A race in the Linux kernel device-mapper resume path can read freed memory when two ioctls on the same device swap tables concurrently. The sources say only root can trigger it and that the kernel maintainers do not consider it a security bug.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","lvm","dm-crypt"],"confidence":0.6,"needs_auth":"yes","worst_case":"root user reads freed kernel memory, causing instability or crash","analyst_note":"Confirm affected kernel version ranges and fixed stable releases from the NVD entry or kernel.org stable commit for the do_resume fix.","how_to_check":"- `uname -r` to see the running kernel version\n- unknown for whether the running kernel contains the fix","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Systems with Linux device-mapper in use, such as LVM or dm-crypt volumes, on a kernel without the fix. Per the sources only root can trigger it, and common tools like lvm and cryptsetup do not issue the ioctls concurrently, so exposure to an attacker is low. The sources do not name affected kernel version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000621,"input_tokens":3525,"output_tokens":536,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99036':15A,18A 'acceident':239C 'also':180C 'anoth':120C 'attempt':192C 'bug':70B,209C 'call':92C,100C,198C,228C 'case':142C 'commit':160C 'common':218C 'concurr':50B,121C,231C 'condit':154C 'consid':66B 'crypt':21B 'cryptsetup':225C 'cve':13A,16A 'derefer':194C 'devic':4A,33B,47B,126C 'device-mapp':3A,32B 'dm':20B,81C,93C,131C,136C,143C,172C,183C 'dm-crypt':19B 'doesn':190C 'done':102C 'fix':82C,161C 'follow':76C 'free':84C 'freed':8A,39B,150C 'function':189C 'get':95C,138C,145C 'hold':104C,109C 'ima':184C 'infrastructur':22B 'ioctl':43B,122C,230C 'kernel':2A,23B,31B,62B,74C 'linux':1A,24B,30B,73C 'lock':106C 'lvm':25B,223C 'maintain':63B 'map':98C,148C,178C 'mapper':5A,34B 'may':116C 'md':114C 'measur':186C 'memori':9A,40B,85C,151C 'mode':96C,139C,146C,166C 'need':185C 'new':97C,147C,169C,177C 'note':175C,202C 'pass':181C 'path':36B 'possibl':118C 'race':6A,27B,153C,163C 'read':7A,38B,83C,149C,165C 'refer':111C 'resolv':80C 'resum':12A,35B,88C,91C 'root':55B,212C 'safe':201C 'say':53B 'secur':69B,208C 'sourc':52B 'swap':48B,128C,132C,173C 'syzbot':158C 'tabl':11A,49B,94C,129C,133C,137C,144C,170C,174C 'tool':220C 'trigger':57B,156C,214C,237C 'two':42B 'use':219C 'vulner':77C 'without':103C","nicknames":[],"mitigations":[],"who_affected":"Systems with Linux device-mapper in use, such as LVM or dm-crypt volumes, on a kernel without the fix. Per the sources only root can trigger it, and common tools like lvm and cryptsetup do not issue the ioctls concurrently, so exposure to an attacker is low. The sources do not name affected kernel version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99036","severity":null,"published_at":"2026-10-23T13:17:26+00:00","modified_at":"2026-10-23T13:17:26+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99036","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99036","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}