VulnerabilityPublished 24 Jun 2026Updated 6 Nov 2026

CVE-2026-53064: Linux kernel · dm cache: fix null-deref with concurrent writes in passthrough mode

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ee38fb00e1a80f46a4990e38f25ecb04ae7b7417 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:49 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ee38fb00e1a80f46a4990e38f25ecb04ae7b7417, df3b8ef06cc62de4fca5d2108e285085b3cffd44, c7fb6bc864c4910b344dafa36dd5028e9b980768 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ b29d4986d0da1a27cd35917cdb433672f5c95d7f, < ee38fb00e1a80f46a4990e38f25ecb04ae7b7417	Fixed in ee38fb00e1a80f46a4990e38f25ecb04ae7b7417
LinuxLinux	Affected ≥ b29d4986d0da1a27cd35917cdb433672f5c95d7f, < df3b8ef06cc62de4fca5d2108e285085b3cffd44	Fixed in df3b8ef06cc62de4fca5d2108e285085b3cffd44
LinuxLinux	Affected ≥ b29d4986d0da1a27cd35917cdb433672f5c95d7f, < c7fb6bc864c4910b344dafa36dd5028e9b980768	Fixed in c7fb6bc864c4910b344dafa36dd5028e9b980768
LinuxLinux	Affected ≥ b29d4986d0da1a27cd35917cdb433672f5c95d7f, < a2635d541a93fd111e743cf14b6275dc81be2abc	Fixed in a2635d541a93fd111e743cf14b6275dc81be2abc
LinuxLinux	Affected ≥ b29d4986d0da1a27cd35917cdb433672f5c95d7f, < 01264a6a3a3ad7ac1d73443299cd5a9568002454	Fixed in 01264a6a3a3ad7ac1d73443299cd5a9568002454
LinuxLinux	Affected ≥ b29d4986d0da1a27cd35917cdb433672f5c95d7f, < 25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15	Fixed in 25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15

Description

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix null-deref with concurrent writes in passthrough mode In passthrough mode, when dm-cache starts to invalidate a cache entry and bio prison cell lock fails due to concurrent write to the same cached block, mg->cell remains NULL. The error path in invalidate_complete() attempts to unlock and free the cell unconditionally, causing a NULL pointer dereference: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 134 Comm: fio Not tainted 6.19.0-rc7 #3 PREEMPT RIP: 0010:dm_cell_unlock_v2+0x3f/0x210 <snip> Call Trace: invalidate_complete+0xef/0x430 map_bio+0x130f/0x1a10 cache_map+0x320/0x6b0 __map_bio+0x458/0x510 dm_submit_bio+0x40e/0x16d0 __submit_bio+0x419/0x870 <snip> Reproduce steps: 1. Create a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Promote the first data block into cache fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \ --direct=1 --size=64k 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the first cached block concurrently fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \ --randrepeat=0 --direct=1 --numjobs=2 --size 64k Fix by checking if mg->cell is valid before attempting to unlock it.

References

Community reviews

Loading reviews…