CVE-2026-89998

CVE-2026-89998 is a race condition (invalid memory access) in the Linux kernel's device-mapper (dm) subsystem. It is triggered when userspace issues two concurrent table-load ioctls and one succeeds while the other fails: dm_setup_md_queue walks the md->table_devices list without holding a lock, and if this walk races with dm_table_destroy -> free_devices -> dm_put_table_device, the kernel accesses freed memory. A local attacker with low privileges who can reach the device-mapper control interface could potentially crash the system or achieve memory corruption with high confidentiality, integrity, and availability impact per the CVSS score. Any Linux system running a kernel with the device-mapper table-load code (i.e., broadly all mainstream kernels, including systems using LVM, dm-crypt, or multipath) is affected until patched. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so no exploitation has been reported.

What to do: Update the Linux kernel to a version that includes the dm fix extending the lock over the table_devices list walk in dm_setup_md_queue. As a compensating measure, ensure /dev/mapper/control keeps restrictive permissions (root-only, the distribution default) and audit for local users or containers with access to it. Check your vendor's kernel changelog for the 'dm: fix race when loading and unloading a table' commit before deploying.