CVE-2026-89576

A flaw was found in the Linux kernel's device-mapper era (dm-era) component. When a snapshot operation fails, a block of metadata is allocated but not properly freed. This leads to a permanent leak of system resources with each failed attempt. Over time, this resource exhaustion can result in a Denial of Service (DoS), causing the system to become unresponsive or crash.

A low impact flaw was found in the Linux kernel's device-mapper era (dm-era) target. When taking a dm-era metadata snapshot, metadata_take_snap() bumps the live superblock reference count and dm_tm_shadow_block() allocates a new block for the snapshot. If the subsequent dm_sm_inc_block() of the writeset_tree_root or era_array_root fails, the error path returns without returning the newly allocated shadow block to the metadata space map, so each failed snapshot attempt permanently leaks one metadata block. Repeated failures can progressively exhaust the metadata space of a dm-era device and ultimately cause a local denial of service. Triggering the vulnerable path requires privileged local access to configure device-mapper targets and perform dm-era metadata snapshot operations.

Red Hat Product Security rates this flaw as low impact; the Red Hat CVSS 3.1 score is 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, moderate). The vulnerable code is present in the kernels shipped in Red Hat Enterprise Linux 8, 9, and 10 and in the Red Hat Enterprise Linux CoreOS kernels used by OpenShift Container Platform 4 and 5, so those products are marked affected. The fix is deferred for these products because the impact is moderate with a CVSS score below 7.0, for which trackers are not filed; the residual risk is a denial of service limited to systems that repeatedly perform dm-era metadata snapshot operations that fail. The Red Hat Enterprise Linux 7 kernel and kernel-rt are not affected because the vulnerable code is not present in those builds, and Red Hat Enterprise Linux 6 is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.