CVE-2026-89576
dm-era: fix shadowed superblock leak on take-snap failure
Description
In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap() bumps the live superblock refcount and then dm_tm_shadow_block() allocates a new block for the metadata snapshot. If the subsequent dm_sm_inc_block() of writeset_tree_root or era_array_root fails, the function only unlocks the clone and returns. The newly allocated shadow block is never returned to the metadata space map, so each failed take-snap permanently leaks one metadata block. Free the clone with dm_sm_dec_block() on those error paths, matching the final step of metadata_drop_snap().
INFO
Published Date :
Sept. 11, 2026, 8:19 p.m.
Last Modified :
Sept. 14, 2026, 1:19 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Free the clone with dm_sm_dec_block() on error paths.
- Ensure allocated shadow blocks are returned to metadata space.
- Apply kernel updates to resolve the leak.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-89576.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-89576 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-89576
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-89576 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-89576 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 14, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/89xxx/CVE-2026-89576.json">CVE-2026-89576</a> Added Reference https://git.kernel.org/stable/c/54dd21ca945ecc07885012b9f3e8197f091cfba0 Added Reference https://git.kernel.org/stable/c/dc731d7fddfd6149f5e88ea080475d18c36d3c64 Added Reference https://git.kernel.org/stable/c/e9fa68b89214bc65af0ef963af7ec3cce9f866e0 Added Reference https://git.kernel.org/stable/c/ef00efb6fcaee88f50891279ceced17c614e97f7 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 11, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap() bumps the live superblock refcount and then dm_tm_shadow_block() allocates a new block for the metadata snapshot. If the subsequent dm_sm_inc_block() of writeset_tree_root or era_array_root fails, the function only unlocks the clone and returns. The newly allocated shadow block is never returned to the metadata space map, so each failed take-snap permanently leaks one metadata block. Free the clone with dm_sm_dec_block() on those error paths, matching the final step of metadata_drop_snap(). Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/89xxx/CVE-2026-89576.json">CVE-2026-89576</a> Added Reference https://git.kernel.org/stable/c/36ff918637e3517f732188a3c39dbeae5b9cfb1b Added Reference https://git.kernel.org/stable/c/39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713 Added Reference https://git.kernel.org/stable/c/6876ca330e741fb8886d12070cb6a7f9cb67257e Added Reference https://git.kernel.org/stable/c/d66ceeefb87ddb097b0546bafc581380b816b048