{"api_version":"1","generated_at":"2026-09-18T01:06:17+00:00","cve":"CVE-2026-89997","urls":{"html":"https://cve.report/CVE-2026-89997","api":"https://cve.report/api/cve/CVE-2026-89997.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89997","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89997"},"summary":{"title":"dm: fix resume-vs-remove race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix resume-vs-remove race\n\nIf the user issues the resume ioctl and the remove ioctl at the same\ntime, it may be possible that the device is resumed after it is suspended\nin __dm_destroy. The result is that the table is destroyed without\ncalling the postsuspend method.\n\nDm targets expect that they may be removed only after the postsuspend\nmethod method was called. If we break this expectation, it can cause\nmisbehavior in various targets. For example - in the dm-integrity target,\nthe reboot notifier is not unregistered, leading to use-after-free.\n\nFix this bug by refusing to resume if the device is being destroyed.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-16 11:17:10","updated_at":"2026-09-17 10:17:05"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/3b59530b14fde693e41d8e39bc326df6cbf07b76","name":"https://git.kernel.org/stable/c/3b59530b14fde693e41d8e39bc326df6cbf07b76","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/44b43ec132f1cf3275ecc182d0c82f50c3c4c3d5","name":"https://git.kernel.org/stable/c/44b43ec132f1cf3275ecc182d0c82f50c3c4c3d5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/36177beff2a9df035991ad8d16ccf8d363ed93ee","name":"https://git.kernel.org/stable/c/36177beff2a9df035991ad8d16ccf8d363ed93ee","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/94f3d399c1ddba763c1c5a6501f7375d533d789f","name":"https://git.kernel.org/stable/c/94f3d399c1ddba763c1c5a6501f7375d533d789f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/1ede2bce2bd640605df83db1356fd727159bc9ed","name":"https://git.kernel.org/stable/c/1ede2bce2bd640605df83db1356fd727159bc9ed","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9757367bcf1d5d2c50b94d005abca21f3eedd7c3","name":"https://git.kernel.org/stable/c/9757367bcf1d5d2c50b94d005abca21f3eedd7c3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3f04e6520d9a53adb1d1daf4dc5d31a60fc77d1f","name":"https://git.kernel.org/stable/c/3f04e6520d9a53adb1d1daf4dc5d31a60fc77d1f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/94380ecd5ff9b2a2b9f6e8a0b5c465159ccfaf71","name":"https://git.kernel.org/stable/c/94380ecd5ff9b2a2b9f6e8a0b5c465159ccfaf71","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89997","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89997","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3f77316de0ec0fd208467fbee8d9edc70e2c73b2 9757367bcf1d5d2c50b94d005abca21f3eedd7c3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3f77316de0ec0fd208467fbee8d9edc70e2c73b2 1ede2bce2bd640605df83db1356fd727159bc9ed git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3f77316de0ec0fd208467fbee8d9edc70e2c73b2 3f04e6520d9a53adb1d1daf4dc5d31a60fc77d1f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3f77316de0ec0fd208467fbee8d9edc70e2c73b2 94f3d399c1ddba763c1c5a6501f7375d533d789f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3f77316de0ec0fd208467fbee8d9edc70e2c73b2 3b59530b14fde693e41d8e39bc326df6cbf07b76 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3f77316de0ec0fd208467fbee8d9edc70e2c73b2 36177beff2a9df035991ad8d16ccf8d363ed93ee git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3f77316de0ec0fd208467fbee8d9edc70e2c73b2 94380ecd5ff9b2a2b9f6e8a0b5c465159ccfaf71 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3f77316de0ec0fd208467fbee8d9edc70e2c73b2 44b43ec132f1cf3275ecc182d0c82f50c3c4c3d5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 305b06f7334dd43bc952b525d7232f4cae7c3818 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.35.4 2.6.36 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.36","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.36 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.270 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.221 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.188 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.51 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.5 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/md/dm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9757367bcf1d5d2c50b94d005abca21f3eedd7c3","status":"affected","version":"3f77316de0ec0fd208467fbee8d9edc70e2c73b2","versionType":"git"},{"lessThan":"1ede2bce2bd640605df83db1356fd727159bc9ed","status":"affected","version":"3f77316de0ec0fd208467fbee8d9edc70e2c73b2","versionType":"git"},{"lessThan":"3f04e6520d9a53adb1d1daf4dc5d31a60fc77d1f","status":"affected","version":"3f77316de0ec0fd208467fbee8d9edc70e2c73b2","versionType":"git"},{"lessThan":"94f3d399c1ddba763c1c5a6501f7375d533d789f","status":"affected","version":"3f77316de0ec0fd208467fbee8d9edc70e2c73b2","versionType":"git"},{"lessThan":"3b59530b14fde693e41d8e39bc326df6cbf07b76","status":"affected","version":"3f77316de0ec0fd208467fbee8d9edc70e2c73b2","versionType":"git"},{"lessThan":"36177beff2a9df035991ad8d16ccf8d363ed93ee","status":"affected","version":"3f77316de0ec0fd208467fbee8d9edc70e2c73b2","versionType":"git"},{"lessThan":"94380ecd5ff9b2a2b9f6e8a0b5c465159ccfaf71","status":"affected","version":"3f77316de0ec0fd208467fbee8d9edc70e2c73b2","versionType":"git"},{"lessThan":"44b43ec132f1cf3275ecc182d0c82f50c3c4c3d5","status":"affected","version":"3f77316de0ec0fd208467fbee8d9edc70e2c73b2","versionType":"git"},{"status":"affected","version":"305b06f7334dd43bc952b525d7232f4cae7c3818","versionType":"git"},{"lessThan":"2.6.36","status":"affected","version":"2.6.35.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/md/dm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.36"},{"lessThan":"2.6.36","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.270","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.221","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.51","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.270","versionStartIncluding":"2.6.36","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.221","versionStartIncluding":"2.6.36","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.188","versionStartIncluding":"2.6.36","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"2.6.36","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"2.6.36","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.51","versionStartIncluding":"2.6.36","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.5","versionStartIncluding":"2.6.36","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"2.6.36","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix resume-vs-remove race\n\nIf the user issues the resume ioctl and the remove ioctl at the same\ntime, it may be possible that the device is resumed after it is suspended\nin __dm_destroy. The result is that the table is destroyed without\ncalling the postsuspend method.\n\nDm targets expect that they may be removed only after the postsuspend\nmethod method was called. If we break this expectation, it can cause\nmisbehavior in various targets. For example - in the dm-integrity target,\nthe reboot notifier is not unregistered, leading to use-after-free.\n\nFix this bug by refusing to resume if the device is being destroyed."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local device-mapper ioctls on /dev/mapper/control (ctl_ioctl → DM_DEV_SUSPEND resume and DM_DEV_REMOVE → dm_resume racing __dm_destroy). No network, Bluetooth, or physical-bus path feeds this race.\nAC:L - The attacker issues concurrent resume and remove ioctls on a mapped device they control, owning both sides of the race. __dm_destroy waits for holders while resume already holds a reference, so the window is reliably hit without victim state or an uncontrolled memory layout.\nPR:L - ctl_ioctl requires capable(CAP_SYS_ADMIN). In the most severe reasonable deployment that capability is held by a container, CSI, or LVM/storage-stack administrator with delegated /dev/mapper/control rather than exclusive host root, matching kernel-CNA scoring of other device-mapper ioctl bugs as Low.\nUI:N - The attacker performs every step with its own ioctls (create and optionally suspend the mapped device, then concurrent resume and remove). No separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The use-after-free and resulting kernel corruption stay inside the host kernel's security authority. This is standard kernel memory corruption, not a VM, IOMMU, or sandbox boundary crossing.\nC:H - Skipping postsuspend after resume leaves target objects live after dtr frees them, including the dm-integrity reboot notifier and the dm-snapshot origin list. That use-after-free lets an attacker reclaim the object and obtain an arbitrary kernel read.\nI:H - The same use-after-free (global origin-list entry, reboot notifier, and restarted dm-thin/dm-cache work) is kernel memory corruption that can be turned into an arbitrary write and control-flow hijack, not merely on-disk integrity loss.\nA:H - Use-after-free of target private data, list corruption on _dm_origins, and BUG_ON in dm_integrity_dtr when I/O remains in-progress cause a kernel oops, panic, or hang."}]}],"providerMetadata":{"dateUpdated":"2026-09-17T09:29:22.706Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/9757367bcf1d5d2c50b94d005abca21f3eedd7c3"},{"url":"https://git.kernel.org/stable/c/1ede2bce2bd640605df83db1356fd727159bc9ed"},{"url":"https://git.kernel.org/stable/c/3f04e6520d9a53adb1d1daf4dc5d31a60fc77d1f"},{"url":"https://git.kernel.org/stable/c/94f3d399c1ddba763c1c5a6501f7375d533d789f"},{"url":"https://git.kernel.org/stable/c/3b59530b14fde693e41d8e39bc326df6cbf07b76"},{"url":"https://git.kernel.org/stable/c/36177beff2a9df035991ad8d16ccf8d363ed93ee"},{"url":"https://git.kernel.org/stable/c/94380ecd5ff9b2a2b9f6e8a0b5c465159ccfaf71"},{"url":"https://git.kernel.org/stable/c/44b43ec132f1cf3275ecc182d0c82f50c3c4c3d5"}],"title":"dm: fix resume-vs-remove race","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89997","datePublished":"2026-09-16T10:33:09.302Z","dateReserved":"2026-09-11T19:38:34.780Z","dateUpdated":"2026-09-17T09:29:22.706Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-16 11:17:10","lastModifiedDate":"2026-09-17 10:17:05","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89997","Ordinal":"1","Title":"dm: fix resume-vs-remove race","CVE":"CVE-2026-89997","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89997","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix resume-vs-remove race\n\nIf the user issues the resume ioctl and the remove ioctl at the same\ntime, it may be possible that the device is resumed after it is suspended\nin __dm_destroy. The result is that the table is destroyed without\ncalling the postsuspend method.\n\nDm targets expect that they may be removed only after the postsuspend\nmethod method was called. If we break this expectation, it can cause\nmisbehavior in various targets. For example - in the dm-integrity target,\nthe reboot notifier is not unregistered, leading to use-after-free.\n\nFix this bug by refusing to resume if the device is being destroyed.","Type":"Description","Title":"dm: fix resume-vs-remove race"}]}}}