CVE-2026-89576dm-era: fix shadowed superblock leak on take-snap failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap() bumps the live superblock refcount and then dm_tm_shadow_block() allocates a new block for the metadata snapshot. If the subsequent dm_sm_inc_block() of writeset_tree_root or era_array_root fails, the function only unlocks the clone and returns. The newly allocated shadow block is never returned to the metadata space map, so each failed take-snap permanently leaks one metadata block. Free the clone with dm_sm_dec_block() on those error paths, matching the final step of metadata_drop_snap().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from eec40579d84873dfb7021eb24c50360f073237c5 before 54dd21ca945ecc07885012b9f3e8197f091cfba0; from eec40579d84873dfb7021eb24c50360f073237c5 before ef00efb6fcaee88f50891279ceced17c614e97f7; from eec40579d84873dfb7021eb24c50360f073237c5 before e9fa68b89214bc65af0ef963af7ec3cce9f866e0; from eec40579d84873dfb7021eb24c50360f073237c5 before dc731d7fddfd6149f5e88ea080475d18c36d3c64; from eec40579d84873dfb7021eb24c50360f073237c5 before d66ceeefb87ddb097b0546bafc581380b816b048; from eec40579d84873dfb7021eb24c50360f073237c5 before 36ff918637e3517f732188a3c39dbeae5b9cfb1b; from eec40579d84873dfb7021eb24c50360f073237c5 before 6876ca330e741fb8886d12070cb6a7f9cb67257e; from eec40579d84873dfb7021eb24c50360f073237c5 before 39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713 | CNA record |
References
- https://git.kernel.org/stable/c/54dd21ca945ecc07885012b9f3e8197f091cfba0
- https://git.kernel.org/stable/c/ef00efb6fcaee88f50891279ceced17c614e97f7
- https://git.kernel.org/stable/c/e9fa68b89214bc65af0ef963af7ec3cce9f866e0
- https://git.kernel.org/stable/c/dc731d7fddfd6149f5e88ea080475d18c36d3c64
- https://git.kernel.org/stable/c/d66ceeefb87ddb097b0546bafc581380b816b048
- https://git.kernel.org/stable/c/36ff918637e3517f732188a3c39dbeae5b9cfb1b
- https://git.kernel.org/stable/c/6876ca330e741fb8886d12070cb6a7f9cb67257e
- https://git.kernel.org/stable/c/39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.