CVE-2026-53064

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm cache: fix null-deref with concurrent writes in passthrough mode

In passthrough mode, when dm-cache starts to invalidate a cache

entry and bio prison cell lock fails due to concurrent write to

the same cached block, mg->cell remains NULL. The error path in

invalidate_complete() attempts to unlock and free the cell

unconditionally, causing a NULL pointer dereference:

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

CPU: 0 UID: 0 PID: 134 Comm: fio Not tainted 6.19.0-rc7 #3 PREEMPT

RIP: 0010:dm_cell_unlock_v2+0x3f/0x210

<snip>

Call Trace:

invalidate_complete+0xef/0x430

map_bio+0x130f/0x1a10

cache_map+0x320/0x6b0

__map_bio+0x458/0x510

dm_submit_bio+0x40e/0x16d0

__submit_bio+0x419/0x870

<snip>

Reproduce steps:

1. Create a cache device

dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"

dmsetup create cdata --table "0 131072 linear /dev/sdc 8192"

dmsetup create corig --table "0 26214

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References