VulnerabilityPublished 23 Oct 2026

CVE-2026-99036: Linux kernel · dm: fix reading free memory in do_resume

Source GCVE Database

Authoritative record:CVE-2026-99036· Low

Not known to be exploited · fixed in e3bf232c913b7e0103d323f15e6342d37cb1b357 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Low

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e3bf232c913b7e0103d323f15e6342d37cb1b357, c9417c1c5269e2bd0570fbe53e4ec03a8d31f008, 301691c32b8ad023e3316d5dbb6a8cf52d47b0dc +2

Exploitation evidence

Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-4cj3-mpcr-rfqf

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ d58168763f74d1edbc296d7038c60efe6493fdd4, < e3bf232c913b7e0103d323f15e6342d37cb1b357	Fixed in e3bf232c913b7e0103d323f15e6342d37cb1b357
LinuxLinux	Affected ≥ d58168763f74d1edbc296d7038c60efe6493fdd4, < c9417c1c5269e2bd0570fbe53e4ec03a8d31f008	Fixed in c9417c1c5269e2bd0570fbe53e4ec03a8d31f008
LinuxLinux	Affected ≥ d58168763f74d1edbc296d7038c60efe6493fdd4, < 301691c32b8ad023e3316d5dbb6a8cf52d47b0dc	Fixed in 301691c32b8ad023e3316d5dbb6a8cf52d47b0dc
LinuxLinux	Affected ≥ d58168763f74d1edbc296d7038c60efe6493fdd4, < 281f68d6cf8acb2547ebf0a849b8beae8fb0ec3c	Fixed in 281f68d6cf8acb2547ebf0a849b8beae8fb0ec3c
LinuxLinux	Affected ≥ d58168763f74d1edbc296d7038c60efe6493fdd4, < 2c96d1a8324e7736e0f8a5790ecf39d36c2c4a82	Fixed in 2c96d1a8324e7736e0f8a5790ecf39d36c2c4a82
LinuxLinux	Affected =2.6.29	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do_resume When do_resume calls dm_table_get_mode(new_map), the call is done without holding any locks (it only holds a reference to the md). It may be possible that another concurrent ioctl on the same device will swap table after dm_swap_table and before dm_table_get_mode. In this case, dm_table_get_mode(new_map) reads freed memory. This race condition was triggered by syzbot. This commit fixes the race by reading mode of the new table before dm_swap_table. Note that new_map is also passed to dm_ima_need_measure, but this function doesn't attempt to dereference it, so this call should be safe. Note that this is not a security bug because only root can trigger it and the commonly used tools such as lvm or cryptsetup do not call the ioctls concurrently, so that they can't trigger it acceidentally.

References

Community reviews

Loading reviews…