---
id: "CVE-2026-99036"
kind: "vulnerability"
aliases: ["CVE-2026-99036"]
title: "Linux kernel device-mapper: race reads freed memory during table resume"
severity: "low"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dm-crypt", "infrastructure", "kernel", "linux", "lvm"]
not_affected_if: ["no-untrusted-local-users"]
published_at: "2026-10-23T13:17:26+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99036", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-99036", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel device-mapper: race reads freed memory during table resume

A race in the Linux kernel device-mapper resume path can read freed memory when two ioctls on the same device swap tables concurrently. The sources say only root can trigger it and that the kernel maintainers do not consider it a security bug.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` to see the running kernel version
- unknown for whether the running kernel contains the fix

## Fix

- Update to a Linux kernel build that includes the upstream commit fixing the do_resume race in dm (version unknown)

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99036
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-99036

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

dm: fix reading free memory in do_resume

When do_resume calls dm_table_get_mode(new_map), the call is done without
holding any locks (it only holds a reference to the md). It may be
possible that another concurrent ioctl on the same device will swap table
after dm_swap_table and before dm_table_get_mode. In this case,
dm_table_get_mode(new_map) reads freed memory.

This race condition was triggered by syzbot.

This commit fixes the race by reading mode of the new table before
dm_swap_table. Note that new_map is also passed to dm_ima_need_measure,
but this function doesn't attempt to dereference it, so this call should
be safe.

Note that this is not a security bug because only root can trigger it and
the commonly used tools such as lvm or cryptsetup do not call the ioctls
concurrently, so that they can't trigger it acceidentally.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_