5.5
MEDIUM CVSS 3.1
CVE-2026-53064
dm cache: fix null-deref with concurrent writes in passthrough mode
Description

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix null-deref with concurrent writes in passthrough mode In passthrough mode, when dm-cache starts to invalidate a cache entry and bio prison cell lock fails due to concurrent write to the same cached block, mg->cell remains NULL. The error path in invalidate_complete() attempts to unlock and free the cell unconditionally, causing a NULL pointer dereference: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 134 Comm: fio Not tainted 6.19.0-rc7 #3 PREEMPT RIP: 0010:dm_cell_unlock_v2+0x3f/0x210 <snip> Call Trace: invalidate_complete+0xef/0x430 map_bio+0x130f/0x1a10 cache_map+0x320/0x6b0 __map_bio+0x458/0x510 dm_submit_bio+0x40e/0x16d0 __submit_bio+0x419/0x870 <snip> Reproduce steps: 1. Create a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Promote the first data block into cache fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \ --direct=1 --size=64k 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the first cached block concurrently fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \ --randrepeat=0 --direct=1 --numjobs=2 --size 64k Fix by checking if mg->cell is valid before attempting to unlock it.

INFO

Published Date :

June 24, 2026, 5:17 p.m.

Last Modified :

July 21, 2026, 5:36 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-53064 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 MEDIUM [email protected]
Solution
Address null pointer dereference by checking cell validity before unlocking.
  • Apply the provided kernel patch.
  • Update the Linux kernel to a fixed version.
  • Rebuild and deploy the patched kernel.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-53064 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-53064 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-53064 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-53064 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Jul. 21, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
    Added CWE CWE-476
    Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.12 up to (excluding) 5.10.258
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/01264a6a3a3ad7ac1d73443299cd5a9568002454 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/0aa745fea1f8dc81bcdd0a45e215b6706727b482 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/7d1f98d668ee34c1d15bdc0420fdd062f24a27c0 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/a2635d541a93fd111e743cf14b6275dc81be2abc Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/c7fb6bc864c4910b344dafa36dd5028e9b980768 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/df3b8ef06cc62de4fca5d2108e285085b3cffd44 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/ee38fb00e1a80f46a4990e38f25ecb04ae7b7417 Types: Patch
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jun. 24, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': '01264a6a3a3ad7ac1d73443299cd5a9568002454', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': 'ee38fb00e1a80f46a4990e38f25ecb04ae7b7417', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': 'c7fb6bc864c4910b344dafa36dd5028e9b980768', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': '0aa745fea1f8dc81bcdd0a45e215b6706727b482', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': 'a2635d541a93fd111e743cf14b6275dc81be2abc', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': '25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': 'df3b8ef06cc62de4fca5d2108e285085b3cffd44', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': '7d1f98d668ee34c1d15bdc0420fdd062f24a27c0', 'versionType': 'git'}], 'programFiles': ['drivers/md/dm-cache-target.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/md/dm-cache-target.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: dm cache: fix null-deref with concurrent writes in passthrough mode In passthrough mode, when dm-cache starts to invalidate a cache entry and bio prison cell lock fails due to concurrent write to the same cached block, mg->cell remains NULL. The error path in invalidate_complete() attempts to unlock and free the cell unconditionally, causing a NULL pointer dereference: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 134 Comm: fio Not tainted 6.19.0-rc7 #3 PREEMPT RIP: 0010:dm_cell_unlock_v2+0x3f/0x210 <snip> Call Trace: invalidate_complete+0xef/0x430 map_bio+0x130f/0x1a10 cache_map+0x320/0x6b0 __map_bio+0x458/0x510 dm_submit_bio+0x40e/0x16d0 __submit_bio+0x419/0x870 <snip> Reproduce steps: 1. Create a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Promote the first data block into cache fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \ --direct=1 --size=64k 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the first cached block concurrently fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \ --randrepeat=0 --direct=1 --numjobs=2 --size 64k Fix by checking if mg->cell is valid before attempting to unlock it.
    Added Reference https://git.kernel.org/stable/c/01264a6a3a3ad7ac1d73443299cd5a9568002454
    Added Reference https://git.kernel.org/stable/c/0aa745fea1f8dc81bcdd0a45e215b6706727b482
    Added Reference https://git.kernel.org/stable/c/25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15
    Added Reference https://git.kernel.org/stable/c/7d1f98d668ee34c1d15bdc0420fdd062f24a27c0
    Added Reference https://git.kernel.org/stable/c/a2635d541a93fd111e743cf14b6275dc81be2abc
    Added Reference https://git.kernel.org/stable/c/c7fb6bc864c4910b344dafa36dd5028e9b980768
    Added Reference https://git.kernel.org/stable/c/df3b8ef06cc62de4fca5d2108e285085b3cffd44
    Added Reference https://git.kernel.org/stable/c/ee38fb00e1a80f46a4990e38f25ecb04ae7b7417
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.