CVE-2026-89997

A flaw was found in the Linux kernel's device mapper (dm) component. A local attacker could exploit a race condition between the resume and remove input/output control (ioctl) operations. This could lead to a use-after-free vulnerability, potentially allowing for arbitrary code execution or denial of service.

A race in device mapper can occur when resume ioctl and remove ioctl are issued at the same time. The mapped device may be resumed after it was suspended in __dm_destroy, so the active table can be destroyed without calling the target postsuspend callback. Some dm targets rely on postsuspend as part of their removal lifetime rules. In dm-integrity this can leave a reboot notifier registered after the target object is freed, creating a use after free condition. For the CVSS the PR:L is used for the higher risk interpretation because device mapper control is normally administrative, but it may be reachable by a delegated local storage service account or a reduced capability root context in some deployments. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel use after free, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.