PT-2026-51954 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-53060

NVD

In the Linux kernel, the following vulnerability has been resolved:

dm cache metadata: fix memory leak on metadata abort retry

When failing to acquire the root lock in dm cache metadata abort because the block manager is read-only, the temporary block manager created outside the root lock is not properly released, causing a memory leak.

Reproduce steps:

This can be reproduced by reloading a new table while the metadata is read-only. While the second call to dm cache metadata abort is caused by lack of support for table preload in dm-cache, mentioned in commit 9b1cc9f251af ("dm cache: share cache-metadata object across inactive and active DM tables"), it exposes the memory leak in dm cache metadata abort when the function is called multiple times. Specifically, dm-cache fails to sync the new cache object's mode during preresume, creating the reproducer condition.

This issue could also occur through concurrent metadata operation failed calls due to races in cache mode updates, but the table preload scenario below provides a reliable reproducer.

1. Create a cache device with some faulty trailing metadata blocks

dmsetup create cmeta <<EOF 0 200 linear /dev/sdc 0 200 7992 error EOF dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 131072 cache /dev/mapper/cmeta /dev/mapper/cdata /dev/mapper/corig 128 1 writethrough smq 0"

2. Suspend and resume the cache to start a new metadata transaction and trigger metadata io errors on the next metadata commit.

dmsetup suspend cache dmsetup resume cache

3. Write to the cache device to update metadata

fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k --randrepeat=0 --direct=1 --size 64k

4. Preload the same table

dmsetup reload cache --table "$(dmsetup table cache)"

5. Resume the new table. This triggers the memory leak.

dmsetup suspend cache dmsetup resume cache

kmemleak logs:

unreferenced object 0xffff8880080c2010 (size 16): comm "dmsetup", pid 132, jiffies 4294982580 hex dump (first 16 bytes): 00 38 b9 07 80 88 ff ff 6a 6b 6b 6b 6b 6b 6b a5 ... backtrace (crc 3118f31c): kmemleak alloc+0x28/0x40 kmalloc cache noprof+0x3d9/0x510 dm block manager create+0x51/0x140 dm cache metadata abort+0x85/0x320 metadata operation failed+0x103/0x1e0 cache preresume+0xacd/0xe70 dm table resume targets+0xd3/0x320 dm resume+0x1b/0xf0 dm resume+0x127/0x170

Related Identifiers

CVE-2026-53060

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53060 · Security Note
• https://git.kernel.org/stable/c/14f60e957f34f95a626caec76a8fae88cf4c397f · Note
• https://git.kernel.org/stable/c/4311ca59a1891d33c4c8b7946f98c34f167fe833 · Note
• https://git.kernel.org/stable/c/15c30997dca681f90dbf2d45ee629c1828bf0c0d · Note
• https://git.kernel.org/stable/c/d1a79620c419a0af1911f99c873014b30740e303 · Note
• https://git.kernel.org/stable/c/b0bd35535bdb6f58505f3a30ee5793986943997a · Note
• https://git.kernel.org/stable/c/322a3b70368d49e39591fe9fc6c07d262128b05f · Note
• https://git.kernel.org/stable/c/6b97cc7a42905755c56bbddc33aa8b792205caee · Note
• https://git.kernel.org/stable/c/044ca491d4086dc5bf233e9fcb71db52df32f633 · Note