CVE-2026-89998

A flaw was found in the Linux kernel's device mapper (dm) subsystem. A local user could trigger a race condition by calling two concurrent table load input/output controls (ioctls). This race condition, occurring during the processing of device mapper tables, can lead to access to invalid memory. Successful exploitation of this vulnerability could result in a system crash, causing a denial of service (DoS).

A race in the device mapper table load path can occur when two concurrent table load ioctls run and one succeeds while the other fails. dm_setup_md_queue walked md table_devices without holding table_devices_lock across the full list traversal, while the failing path could destroy the table and release devices through dm_table_destroy, free_devices, and dm_put_table_device. This creates an access to invalid memory and should be treated as a use-after-free candidate rather than a pure logic bug. For the CVSS the PR:L is used for the paranoid score because some deployments may expose device mapper operations through delegated storage management, container root, or reduced-capability service accounts instead of full host administration. The issue is local and not network reachable. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.