{"id":"CVE-2026-99256","kind":"vulnerability","aliases":["CVE-2026-99256"],"related":[],"title":"Linux kernel: dm cache lock misuse triggers kernel warning on suspend and resume","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix issue with background work locking\n\ndm cache used a rw_semaphore for background_work_lock. Write locks on\nrw_semaphores have strict owner semantics, but there was no guarantee\nthat the process that locked background_work_lock was the same process\nthat unlocked it. This can be easily seen using a kernel compiled with\nCONFIG_DEBUG_RWSEMS. Given a dm cache device <cache>, run: 'dmsetup\nsuspend <cache> && dmsetup resume <cache>'. This will trigger a kernel\nwarning:\n\nDEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE))\n\ntriggered by cache_resume(). To fix this, switch from a rw_semaphore to\na spinlock and a wait queue. dm cache already has a wait queue and\nassociated counter, migration_wait and nr_allocated_migrations, that was\ngetting woken up when background work was getting completed, but wasn't\nactually used by anything. This is replaced by the background_work queue\nand counter.","summary":"The device-mapper cache target in the Linux kernel released a read-write semaphore from a different process than the one that locked it, which trips a debug warning when a cache device is suspended and resumed. The sources describe a kernel warning and a lock fix; they do not describe code execution or data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-mapper","dm-cache","kernel","linux","runtime"],"not_affected_if":["default-config","no-dm-cache"],"how_to_check":"- Check whether the kernel is built with `CONFIG_DEBUG_RWSEMS` and whether the host uses dm-cache (`dmsetup status` lists cache targets)\n- Check the running kernel version with `uname -r`","fix":null,"status":"open","published_at":"2026-11-03T12:17:32+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","triaged_at":"2026-11-03T12:22:51+00:00","updated_at":"2026-11-03T12:22:51+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-03T12:22:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: dm cache lock misuse triggers kernel warning on suspend and resume","impact":"low","summary":"The device-mapper cache target in the Linux kernel released a read-write semaphore from a different process than the one that locked it, which trips a debug warning when a cache device is suspended and resumed. The sources describe a kernel warning and a lock fix; they do not describe code execution or data exposure.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux","kernel","device-mapper","dm-cache"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; sources describe only a kernel warning under debug config","analyst_note":"Check the upstream kernel commit and the NVD entry for affected version ranges and whether the lock misuse has any security impact beyond the debug warning.","how_to_check":"- Check whether the kernel is built with `CONFIG_DEBUG_RWSEMS` and whether the host uses dm-cache (`dmsetup status` lists cache targets)\n- Check the running kernel version with `uname -r`\n- unknown for the affected version range, since the sources give none","plain_action":"","needs_analyst":true,"not_affected_if":["no-dm-cache","default-config"],"who_is_affected":"Only systems that use the device-mapper cache target (dm-cache) on Linux, such as servers with cache devices set up through LVM. The sources describe a kernel warning under a debug configuration; they do not say what an attacker gains. Systems that do not use dm-cache can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000739,"input_tokens":4415,"output_tokens":595,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99256':16A,19A 'actual':236C 'alloc':220C 'alreadi':208C 'anyth':239C 'associ':214C 'background':102C,112C,134C,228C,245C 'cach':4A,25B,33B,62B,98C,106C,160C,189C,207C 'code':82B 'compil':152C 'complet':232C 'config':154C 'counter':215C,249C 'current':180C 'cve':14A,17A 'data':85B 'debug':58B,155C,173C 'describ':70B,81B 'devic':21B,31B,63B,161C 'device-mapp':20B,30B 'differ':47B 'dm':3A,24B,97C,105C,159C,206C 'dm-cach':23B 'dmsetup':163C,165C 'easili':147C 'execut':83B 'exposur':86B 'fix':77B,99C,192C 'follow':92C 'get':224C,231C 'given':157C 'guarante':128C 'issu':100C 'kernel':2A,8A,26B,38B,72B,90C,151C,171C 'linux':1A,27B,37B,89C 'lock':5A,53B,76B,104C,114C,116C,133C,136C 'mapper':22B,32B 'migrat':216C,221C 'misus':6A 'nonspinn':186C 'nr':219C 'oflag':183C 'one':51B 'owner':122C,178C 'process':48B,131C,140C 'queue':205C,212C,247C 'read':42B 'read-writ':41B 'releas':39B 'replac':242C 'resolv':96C 'resum':13A,67B,166C,190C 'run':162C 'runtim':28B 'rw':109C,118C,197C 'rwsem':156C,174C,177C,181C,185C 'seen':148C 'sem':179C,184C 'semant':123C 'semaphor':44B,110C,119C,198C 'sourc':69B 'spinlock':201C 'strict':121C 'suspend':11A,65B,164C 'switch':194C 'target':34B 'test':182C 'trigger':7A,169C,187C 'trip':56B 'unlock':142C 'use':107C,149C,237C 'vulner':93C 'wait':204C,211C,217C 'warn':9A,59B,73B,172C,175C 'wasn':234C 'woken':225C 'work':103C,113C,135C,229C,246C 'write':43B,115C","nicknames":[],"mitigations":[],"who_affected":"Only systems that use the device-mapper cache target (dm-cache) on Linux, such as servers with cache devices set up through LVM. The sources describe a kernel warning under a debug configuration; they do not say what an attacker gains. Systems that do not use dm-cache can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["devicemapper","dmcache","kernel","linux","runtime","unknown"],"first_public_at":"2026-11-03T12:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99256","severity":null,"published_at":"2026-11-03T12:17:32+00:00","modified_at":"2026-11-03T12:17:32+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","fetched_at":"2026-11-03T12:20:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}