In the Linux kernel, the following vulnerability has been resolved:
dm cache metadata: fix memory leak on metadata abort retry
When failing to acquire the rootlock in dmcachemetadataabort because the blockmanager is read-only, the temporary blockmanager created outside the root_lock is not properly released, causing a memory leak.
Reproduce steps:
This can be reproduced by reloading a new table while the metadata is read-only. While the second call to dmcachemetadataabort is caused by lack of support for table preload in dm-cache, mentioned in commit 9b1cc9f251af ("dm cache: share cache-metadata object across inactive and active DM tables"), it exposes the memory leak in dmcachemetadataabort when the function is called multiple times. Specifically, dm-cache fails to sync the new cache object's mode during preresume, creating the reproducer condition.
This issue could also occur through concurrent metadataoperationfailed calls due to races in cache mode updates, but the table preload scenario below provides a reliable reproducer.
dmsetup create cmeta <<EOF 0 200 linear /dev/sdc 0 200 7992 error EOF dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 131072 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 1 writethrough smq 0"
dmsetup suspend cache dmsetup resume cache
fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \ --randrepeat=0 --direct=1 --size 64k
dmsetup reload cache --table "$(dmsetup table cache)"
dmsetup suspend cache dmsetup resume cache
kmemleak logs:
<snip> unreferenced object 0xffff8880080c2010 (size 16): comm "dmsetup", pid 132, jiffies 4294982580 hex dump (first 16 bytes): 00 38 b9 07 80 88 ff ff 6a 6b 6b 6b 6b 6b 6b a5 ... backtrace (crc 3118f31c): kmemleak_alloc+0x28/0x40 __kmalloccachenoprof+0x3d9/0x510 dmblockmanagercreate+0x51/0x140 dmcachemetadataabort+0x85/0x320 metadataoperationfailed+0x103/0x1e0 cachepreresume+0xacd/0xe70 dmtableresumetargets+0xd3/0x320 __dmresume+0x1b/0xf0 dmresume+0x127/0x170 <snip>
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53060.json",
"cna_assigner": "Linux"
}