In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap()… (CVE-2026-89576)
A vulnerability in the Linux kernel's device mapper era (dm-era) component caused a metadata block leak when a snapshot creation failed. Specifically, if certain internal reference count increments failed during the snapshot process, the allocated shadow block was not properly freed, resulting in a permanent leak of one metadata block per failure. This issue has been fixed by ensuring the allocated block is correctly released on error paths.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel dm-era subsystem involved a resource leak in the metadata snapshot creation function metadata_take_snap(). When dm_tm_shadow_block() allocated a new block for the snapshot, subsequent failures in dm_sm_inc_block() calls caused the function to return without freeing the allocated shadow block. This led to a permanent leak of metadata blocks. The fix adds calls to dm_sm_dec_block() on the error paths to properly free the allocated clone, aligning with the cleanup performed in metadata_drop_snap().
Potential Impact
The impact is a resource leak of metadata blocks in the device mapper era subsystem of the Linux kernel. Repeated failures in snapshot creation could exhaust metadata space, potentially affecting system stability or functionality related to device mapper snapshots. There is no indication of code execution or privilege escalation from this issue.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to properly free leaked metadata blocks on snapshot creation failure. Users should apply the official kernel updates that include this fix. No additional mitigation steps are indicated.
In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap()… (CVE-2026-89576)
Description
A vulnerability in the Linux kernel's device mapper era (dm-era) component caused a metadata block leak when a snapshot creation failed. Specifically, if certain internal reference count increments failed during the snapshot process, the allocated shadow block was not properly freed, resulting in a permanent leak of one metadata block per failure. This issue has been fixed by ensuring the allocated block is correctly released on error paths.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel dm-era subsystem involved a resource leak in the metadata snapshot creation function metadata_take_snap(). When dm_tm_shadow_block() allocated a new block for the snapshot, subsequent failures in dm_sm_inc_block() calls caused the function to return without freeing the allocated shadow block. This led to a permanent leak of metadata blocks. The fix adds calls to dm_sm_dec_block() on the error paths to properly free the allocated clone, aligning with the cleanup performed in metadata_drop_snap().
Potential Impact
The impact is a resource leak of metadata blocks in the device mapper era subsystem of the Linux kernel. Repeated failures in snapshot creation could exhaust metadata space, potentially affecting system stability or functionality related to device mapper snapshots. There is no indication of code execution or privilege escalation from this issue.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to properly free leaked metadata blocks on snapshot creation failure. Users should apply the official kernel updates that include this fix. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-f7fr-q69f-62x9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89576"]
Threat ID: 6aa4a00f55bf5e2cf5a866a0
Added to database: 09/12/2026, 00:42:55 UTC
Last enriched: 09/12/2026, 01:05:49 UTC
Last updated: 09/12/2026, 01:05:49 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.