Live › vulnerability › CVE-2026-99256
The device-mapper cache target in the Linux kernel released a read-write semaphore from a different process than the one that locked it, which trips a debug warning when a cache device is suspended and resumed. The sources describe a kernel warning and a lock fix; they do not describe code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 12:20 UTC. All times on this page are UTC.
Only systems that use the device-mapper cache target (dm-cache) on Linux, such as servers with cache devices set up through LVM. The sources describe a kernel warning under a debug configuration; they do not say what an attacker gains. Systems that do not use dm-cache can skip it.
No product ranges from the sources yet.
CONFIG_DEBUG_RWSEMS and whether the host uses dm-cache (dmsetup status lists cache targets)uname -rUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix issue with background work locking
dm cache used a rw_semaphore for background_work_lock. Write locks on rw_semaphores have strict owner semantics, but there was no guarantee that the process that locked background_work_lock was the same process that unlocked it. This can be easily seen using a kernel compiled with CONFIG_DEBUG_RWSEMS. Given a dm cache device <cache>, run: 'dmsetup suspend <cache> && dmsetup resume <cache>'. This will trigger a kernel warning:
DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE))
triggered by cache_resume(). To fix this, switch from a rw_semaphore to a spinlock and a wait queue. dm cache already has a wait queue and associated counter, migration_wait and nr_allocated_migrations, that was getting woken up when background work was getting completed, but wasn't actually used by anything. This is replaced by the background_work queue and counter.
This page as .md · .json · in your agent: get_signal("CVE-2026-99256")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.