CVE-2026-53064
dm cache: fix null-deref with concurrent writes in passthrough mode
Description
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix null-deref with concurrent writes in passthrough mode In passthrough mode, when dm-cache starts to invalidate a cache entry and bio prison cell lock fails due to concurrent write to the same cached block, mg->cell remains NULL. The error path in invalidate_complete() attempts to unlock and free the cell unconditionally, causing a NULL pointer dereference: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 134 Comm: fio Not tainted 6.19.0-rc7 #3 PREEMPT RIP: 0010:dm_cell_unlock_v2+0x3f/0x210 <snip> Call Trace: invalidate_complete+0xef/0x430 map_bio+0x130f/0x1a10 cache_map+0x320/0x6b0 __map_bio+0x458/0x510 dm_submit_bio+0x40e/0x16d0 __submit_bio+0x419/0x870 <snip> Reproduce steps: 1. Create a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Promote the first data block into cache fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \ --direct=1 --size=64k 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the first cached block concurrently fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \ --randrepeat=0 --direct=1 --numjobs=2 --size 64k Fix by checking if mg->cell is valid before attempting to unlock it.
INFO
Published Date :
June 24, 2026, 5:17 p.m.
Last Modified :
July 21, 2026, 5:36 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Apply the provided kernel patch.
- Update the Linux kernel to a fixed version.
- Rebuild and deploy the patched kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53064.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53064 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53064
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53064 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53064 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 21, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.12 up to (excluding) 5.10.258 Added Reference Type kernel.org: https://git.kernel.org/stable/c/01264a6a3a3ad7ac1d73443299cd5a9568002454 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/0aa745fea1f8dc81bcdd0a45e215b6706727b482 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/7d1f98d668ee34c1d15bdc0420fdd062f24a27c0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a2635d541a93fd111e743cf14b6275dc81be2abc Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c7fb6bc864c4910b344dafa36dd5028e9b980768 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/df3b8ef06cc62de4fca5d2108e285085b3cffd44 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ee38fb00e1a80f46a4990e38f25ecb04ae7b7417 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': '01264a6a3a3ad7ac1d73443299cd5a9568002454', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': 'ee38fb00e1a80f46a4990e38f25ecb04ae7b7417', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': 'c7fb6bc864c4910b344dafa36dd5028e9b980768', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': '0aa745fea1f8dc81bcdd0a45e215b6706727b482', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': 'a2635d541a93fd111e743cf14b6275dc81be2abc', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': '25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': 'df3b8ef06cc62de4fca5d2108e285085b3cffd44', 'versionType': 'git'}, {'status': 'affected', 'version': 'b29d4986d0da1a27cd35917cdb433672f5c95d7f', 'lessThan': '7d1f98d668ee34c1d15bdc0420fdd062f24a27c0', 'versionType': 'git'}], 'programFiles': ['drivers/md/dm-cache-target.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/md/dm-cache-target.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: dm cache: fix null-deref with concurrent writes in passthrough mode In passthrough mode, when dm-cache starts to invalidate a cache entry and bio prison cell lock fails due to concurrent write to the same cached block, mg->cell remains NULL. The error path in invalidate_complete() attempts to unlock and free the cell unconditionally, causing a NULL pointer dereference: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 134 Comm: fio Not tainted 6.19.0-rc7 #3 PREEMPT RIP: 0010:dm_cell_unlock_v2+0x3f/0x210 <snip> Call Trace: invalidate_complete+0xef/0x430 map_bio+0x130f/0x1a10 cache_map+0x320/0x6b0 __map_bio+0x458/0x510 dm_submit_bio+0x40e/0x16d0 __submit_bio+0x419/0x870 <snip> Reproduce steps: 1. Create a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Promote the first data block into cache fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \ --direct=1 --size=64k 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the first cached block concurrently fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \ --randrepeat=0 --direct=1 --numjobs=2 --size 64k Fix by checking if mg->cell is valid before attempting to unlock it. Added Reference https://git.kernel.org/stable/c/01264a6a3a3ad7ac1d73443299cd5a9568002454 Added Reference https://git.kernel.org/stable/c/0aa745fea1f8dc81bcdd0a45e215b6706727b482 Added Reference https://git.kernel.org/stable/c/25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15 Added Reference https://git.kernel.org/stable/c/7d1f98d668ee34c1d15bdc0420fdd062f24a27c0 Added Reference https://git.kernel.org/stable/c/a2635d541a93fd111e743cf14b6275dc81be2abc Added Reference https://git.kernel.org/stable/c/c7fb6bc864c4910b344dafa36dd5028e9b980768 Added Reference https://git.kernel.org/stable/c/df3b8ef06cc62de4fca5d2108e285085b3cffd44 Added Reference https://git.kernel.org/stable/c/ee38fb00e1a80f46a4990e38f25ecb04ae7b7417