dm-era: fix shadowed superblock leak on take-snap failure
Summary
| CVE | CVE-2026-89576 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-11 20:19:41 UTC |
| Updated | 2026-10-19 09:17:53 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap() bumps the live superblock refcount and then dm_tm_shadow_block() allocates a new block for the metadata snapshot. If the subsequent dm_sm_inc_block() of writeset_tree_root or era_array_root fails, the function only unlocks the clone and returns. The newly allocated shadow block is never returned to the metadata space map, so each failed take-snap permanently leaks one metadata block. Free the clone with dm_sm_dec_block() on those error paths, matching the final step of metadata_drop_snap(). |
Risk And Classification
EPSS: 0.002000000 probability, percentile 0.099540000 (date 2026-09-14)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected eec40579d84873dfb7021eb24c50360f073237c5 54dd21ca945ecc07885012b9f3e8197f091cfba0 git | Not specified |
| CNA | Linux | Linux | affected eec40579d84873dfb7021eb24c50360f073237c5 ef00efb6fcaee88f50891279ceced17c614e97f7 git | Not specified |
| CNA | Linux | Linux | affected eec40579d84873dfb7021eb24c50360f073237c5 e9fa68b89214bc65af0ef963af7ec3cce9f866e0 git | Not specified |
| CNA | Linux | Linux | affected eec40579d84873dfb7021eb24c50360f073237c5 dc731d7fddfd6149f5e88ea080475d18c36d3c64 git | Not specified |
| CNA | Linux | Linux | affected eec40579d84873dfb7021eb24c50360f073237c5 d66ceeefb87ddb097b0546bafc581380b816b048 git | Not specified |
| CNA | Linux | Linux | affected eec40579d84873dfb7021eb24c50360f073237c5 36ff918637e3517f732188a3c39dbeae5b9cfb1b git | Not specified |
| CNA | Linux | Linux | affected eec40579d84873dfb7021eb24c50360f073237c5 6876ca330e741fb8886d12070cb6a7f9cb67257e git | Not specified |
| CNA | Linux | Linux | affected eec40579d84873dfb7021eb24c50360f073237c5 39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713 git | Not specified |
| CNA | Linux | Linux | affected 3.15 | Not specified |
| CNA | Linux | Linux | unaffected 3.15 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.270 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.221 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.188 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.157 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.109 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.50 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2.4 7.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.3 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/d66ceeefb87ddb097b0546bafc581380b816b048 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/6876ca330e741fb8886d12070cb6a7f9cb67257e | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/36ff918637e3517f732188a3c39dbeae5b9cfb1b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/dc731d7fddfd6149f5e88ea080475d18c36d3c64 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/ef00efb6fcaee88f50891279ceced17c614e97f7 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/54dd21ca945ecc07885012b9f3e8197f091cfba0 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/e9fa68b89214bc65af0ef963af7ec3cce9f866e0 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.