CVE-2026-89997

CVE-2026-89997 is a race condition in the Linux kernel's device-mapper (dm) core that can cause a mapped device to be resumed after it has already been suspended for destruction. It is triggered when a local user issues the resume ioctl and the remove ioctl concurrently on a device-mapper device, so the table is destroyed without the required postsuspend method being called. Because dm targets expect to be removed only after postsuspend, breaking this invariant causes misbehavior in various targets; for example, in dm-integrity the reboot notifier is not unregistered, leading to a kernel use-after-free that a low-privileged local user could potentially leverage for privilege escalation or a crash. Any Linux system running a kernel with the vulnerable dm code is affected, with the sharpest impact on configurations using dm-integrity or other targets that rely on postsuspend cleanup. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not listed in CISA's KEV catalog.

What to do: Update to a vendor or kernel.org release that includes the 'dm: fix resume-vs-remove race' patch (fixed version numbers were not provided in the source data, so track your distribution's security advisory or stable-tree backport). Until patched, restrict local access to device-mapper devices such as /dev/mapper/control to trusted users only. Watch for kernel logs showing dm-integrity or other target misbehavior/crashes after concurrent dm operations as an indicator of exposure.