Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99036— dm: fix reading free memory in do_resume

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： dm：修复 do_resume 中读取已释放内存的问题当调用时，该调用未持有任何锁（仅持有对的引用）。此时，若同一设备上存在另一个并发的操作，可能在之后、之前交换设备映射表。在这种情况下，会读取已被释放的内存。该竞态条件由 syzbot 触发。本次提交通过在调用之前读取新表的状态（mode）来修复该竞态。需要注意的是，也会传递给，但该函数不会尝试解引用它，因此该调用是安全的。需要说明的是，这并非一个安全漏洞，因为只有 root 用户才能触发它

AI Predicted 4.4 Difficulty: Hard EPSS 0.18% · P7 Updated Oct 26, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 14

Vendor	Product	Version Range	Status
Linux	Linux	`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 281f68d6cf8acb2547ebf0a849b8beae8fb0ec3c`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 2c96d1a8324e7736e0f8a5790ecf39d36c2c4a82`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< e3bf232c913b7e0103d323f15e6342d37cb1b357`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 301691c32b8ad023e3316d5dbb6a8cf52d47b0dc`	affected
		`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< c9417c1c5269e2bd0570fbe53e4ec03a8d31f008`	affected
		`< 6.6.160`	affected
		`< 6.12.113`	affected
		`< 6.18.57`	affected
… +6 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

dm: fix reading free memory in do_resume

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do_resume When do_resume calls dm_table_get_mode(new_map), the call is done without holding any locks (it only holds a reference to the md). It may be possible that another concurrent ioctl on the same device will swap table after dm_swap_table and before dm_table_get_mode. In this case, dm_table_get_mode(new_map) reads freed memory. This race condition was triggered by syzbot. This commit fixes the race by reading mode of the new table before dm_swap_table. Note that new_map is also passed to dm_ima_need_measure, but this function doesn't attempt to dereference it, so this call should be safe. Note that this is not a security bug because only root can trigger it and the commonly used tools such as lvm or cryptsetup do not call the ioctls concurrently, so that they can't trigger it acceidentally.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	d58168763f74d1edbc296d7038c60efe6493fdd4 ~ 281f68d6cf8acb2547ebf0a849b8beae8fb0ec3c	-
Linux	Linux	2.6.29	-

II. Public POCs for CVE-2026-99036

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99036

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99036 (4)

https://www.cve.org/CVERecord?id=CVE-2026-99036

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959	9.8 CRITICAL	btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988	8.8 HIGH	namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083	8.8 HIGH	ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082	8.8 HIGH	KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98981	8.8 HIGH	namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98980	8.8 HIGH	namei: don't reveal overmounted entries in refwalk
CVE-2026-98870	8.8 HIGH	ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98978	8.4 HIGH	namespace: never expire a locked mount
CVE-2026-99042	8.4 HIGH	io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98968	8.1 HIGH	amt: send the relay's General Query directly from the receive path
CVE-2026-99064	8.1 HIGH	cipso: adjust cached option offsets when removing CIPSO
CVE-2026-99014	7.8 HIGH	Bluetooth: hci_sync: Fix command skb lifetime during scan setup
CVE-2026-98999	7.8 HIGH	drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
CVE-2026-99016	7.8 HIGH	riscv: futex: untag the user pointer before the atomic access
CVE-2026-99018	7.8 HIGH	riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
CVE-2026-99051	7.8 HIGH	fsverity: RCU-delay the freeing of struct fsverity_info
CVE-2026-99054	7.8 HIGH	tipc: destroy topsrv workqueues before closing connections
CVE-2026-99053	7.8 HIGH	tipc: hold a reference to nodes found by link name

Showing top 20 of 217 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux