Read the docs
TI-2026-38149 Aliases CVE-2026-53062GHSA-4j2m-gfqm-629p

dm cache policy smq: fix missing locks in invalidating cache blocks

Priority LOW 35CWE-362Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 25 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-667 and the CVSS impact.

Summary

In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should be protected by a lock. Otherwise, we might end up with data races on the allocated blocks counter, or even use-after-free issues with internal data structures when doing concurrent writes. Note that the existing FIXME in smq_invalidate_mapping() doesn't affect passthrough mode since migration tasks don't exist there, but would need attention if supporting fast device shrinking via suspend/resume without target reloading. Reproduce steps: 1. Create a cache device consisting of 1024 cache entries dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Populate the cache, and record the number of cached blocks fio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k \ --size=64m --direct=1 nr_cached=$(dmsetup status cache | awk '{split($7, a, "/"); print a[1]}') 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the passthrough cache. By setting multiple jobs with I/O size equal to the cache block size, cache blocks are invalidated concurrently from different workers. fio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k \ --direct=1 --numjobs=2 --randrepeat=0 --size=64m 5. Check if demoted matches cached block count. These numbers should match but may differ due to the data race. nr_demoted=$(dmsetup status cache | awk '{print $12}') echo "$nr_cached, $nr_demoted"

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00097 0th percentileScored 2026-11-07
Fix Partial Linux (Linux): 5.10.258, 5.15.209, 6.1.175 +5Red Hat: 10 advisoriesRed Hat: 25 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux4.12 and later5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1Patch availableCNA
  • Linux VendorLinux Affected 4.12 and later Fixed in 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*4.12 to before 5.10.258; 5.11 to before 5.15.209; 5.16 to before 6.1.175; 6.2 to before 6.6.141; 6.7 to before 6.12.91; 6.13 to before 6.18.33; 6.19 to before 7.0.10VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.12 to before 5.10.258; 5.11 to before 5.15.209; 5.16 to before 6.1.175; 6.2 to before 6.6.141; 6.7 to before 6.12.91; 6.13 to before 6.18.33; 6.19 to before 7.0.10 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1

Red Hat 10 advisories

  • RHSA-2026:95721 Released 2026-11-05 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux for Real Time (v. 7 ELS) kernel-rt-3.10.0-1160.169.1.rt56.1321.el7, kernel-rt-debug-3.10.0-1160.169.1.rt56.1321.el7, kernel-rt-debug-devel-3.10.0-1160.169.1.rt56.1321.el7 +4
  • RHSA-2026:95556 Released 2026-11-05 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) bpftool-3.10.0-1160.169.1.el7, kernel-3.10.0-1160.169.1.el7, kernel-abi-whitelists-3.10.0-1160.169.1.el7 +11
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) kernel-debug-devel-3.10.0-1160.169.1.el7, kernel-tools-libs-devel-3.10.0-1160.169.1.el7
  • RHSA-2026:94558 Released 2026-11-03 · Red Hat rating Critical
    kernel-rt security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt-5.14.0-284.202.1.rt14.487.el9_2, kernel-rt-core-5.14.0-284.202.1.rt14.487.el9_2, kernel-rt-debug-5.14.0-284.202.1.rt14.487.el9_2 +9
    • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt-5.14.0-284.202.1.rt14.487.el9_2, kernel-rt-core-5.14.0-284.202.1.rt14.487.el9_2, kernel-rt-debug-5.14.0-284.202.1.rt14.487.el9_2 +11
Show 7 more Red Hat advisories
  • RHSA-2026:94477 Released 2026-11-03 · Red Hat rating Critical
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) kernel-64k-debug-devel-5.14.0-284.202.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.202.1.el9_2, kernel-64k-devel-5.14.0-284.202.1.el9_2 +10
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool-7.0.0-284.202.1.el9_2, kernel-5.14.0-284.202.1.el9_2, kernel-64k-5.14.0-284.202.1.el9_2 +29
  • RHSA-2026:84793 Released 2026-10-19 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) bpftool-4.18.0-477.175.1.el8_8, kernel-4.18.0-477.175.1.el8_8, kernel-abi-stablelists-4.18.0-477.175.1.el8_8 +14
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) bpftool-4.18.0-477.175.1.el8_8, kernel-4.18.0-477.175.1.el8_8, kernel-abi-stablelists-4.18.0-477.175.1.el8_8 +14
  • RHSA-2026:77216 Released 2026-10-07 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) bpftool-4.18.0-372.220.1.el8_6, kernel-4.18.0-372.220.1.el8_6, kernel-abi-stablelists-4.18.0-372.220.1.el8_6 +14
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) bpftool-4.18.0-372.220.1.el8_6, kernel-4.18.0-372.220.1.el8_6, kernel-abi-stablelists-4.18.0-372.220.1.el8_6 +19
  • RHSA-2026:70459 Released 2026-09-23 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-687.50.1.el9_8, kernel-64k-debug-devel-matched-5.14.0-687.50.1.el9_8, kernel-64k-devel-5.14.0-687.50.1.el9_8 +12
    • Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-687.50.1.el9_8, kernel-64k-5.14.0-687.50.1.el9_8, kernel-64k-core-5.14.0-687.50.1.el9_8 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-687.50.1.el9_8, libperf-5.14.0-687.50.1.el9_8
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-687.50.1.el9_8, kernel-rt-64k-5.14.0-687.50.1.el9_8, kernel-rt-64k-core-5.14.0-687.50.1.el9_8 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-687.50.1.el9_8, kernel-rt-core-5.14.0-687.50.1.el9_8, kernel-rt-debug-5.14.0-687.50.1.el9_8 +9
  • RHSA-2026:70498 Released 2026-09-23 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-211.58.1.el10_2, kernel-64k-debug-devel-matched-6.12.0-211.58.1.el10_2, kernel-64k-devel-6.12.0-211.58.1.el10_2 +12
    • Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-211.58.1.el10_2, kernel-64k-6.12.0-211.58.1.el10_2, kernel-64k-core-6.12.0-211.58.1.el10_2 +29
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-211.58.1.el10_2, libperf-6.12.0-211.58.1.el10_2
    • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-211.58.1.el10_2, kernel-rt-64k-6.12.0-211.58.1.el10_2, kernel-rt-64k-core-6.12.0-211.58.1.el10_2 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-211.58.1.el10_2, kernel-rt-core-6.12.0-211.58.1.el10_2, kernel-rt-debug-6.12.0-211.58.1.el10_2 +9
  • RHSA-2026:70402 Released 2026-09-22 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.166.1.el8_10, kernel-4.18.0-553.166.1.el8_10, kernel-abi-stablelists-4.18.0-553.166.1.el8_10 +19
    • Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.166.1.el8_10
  • RHSA-2026:70403 Released 2026-09-22 · Red Hat rating Important
    kernel-rt security, bug fix, and enhancement update
    • Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-553.166.1.rt7.507.el8_10, kernel-rt-core-4.18.0-553.166.1.rt7.507.el8_10, kernel-rt-debug-4.18.0-553.166.1.rt7.507.el8_10 +9
    • Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-553.166.1.rt7.507.el8_10, kernel-rt-core-4.18.0-553.166.1.rt7.507.el8_10, kernel-rt-debug-4.18.0-553.166.1.rt7.507.el8_10 +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:70498
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:70459
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:94477
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:70498
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:70402
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:70459
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:77216
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:84793
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:94477
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:77216
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:84793
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:70402
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:70498
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:70459
Red Hat Enterprise Linux NFV (v. 8)Fixed RHSA-2026:70403
Red Hat Enterprise Linux RT (v. 8)Fixed RHSA-2026:70403
Red Hat Enterprise Linux Real Time (v. 10)Fixed RHSA-2026:70498
Red Hat Enterprise Linux Real Time (v. 9)Fixed RHSA-2026:70459
Red Hat Enterprise Linux Real Time E4S (v.9.2)Fixed RHSA-2026:94558
Red Hat Enterprise Linux Real Time for NFV (v. 10)Fixed RHSA-2026:70498
Red Hat Enterprise Linux Real Time for NFV (v. 9)Fixed RHSA-2026:70459
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)Fixed RHSA-2026:94558
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:95556
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:95556
Red Hat Enterprise Linux for Real Time (v. 7 ELS)Fixed RHSA-2026:95721

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53062
  2. 2026-10-03 Alias added: GHSA-4j2m-gfqm-629p
  3. 2026-10-07 Fix available: RHSA-2026:77216 · Red Hat
  4. 2026-10-07 Fix available: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · Red Hat
  5. 2026-10-16 CISA SSVC decision points changed
  6. 2026-10-19 Weakness changed · CISA ADP
  7. 2026-10-20 Fix available: RHSA-2026:84793 · Red Hat
  8. 2026-10-20 Fix available: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8) · Red Hat
  9. 2026-11-03 Fix available: RHSA-2026:94477 · Red Hat
  10. 2026-11-03 Fix available: RHSA-2026:94558 · Red Hat
  11. 2026-11-03 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2), Red Hat Enterprise Linux Real Time E4S (v.9.2) +1 · Red Hat
  12. 2026-11-06 Fix available: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · Red Hat
  13. 2026-11-06 Fix available: RHSA-2026:95556 · Red Hat
  14. 2026-11-06 Fix available: Red Hat Enterprise Linux for Real Time (v. 7 ELS) · Red Hat
  15. 2026-11-06 Fix available: RHSA-2026:95721 · Red Hat

References

Patch 8

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences