---
id: CVE-2026-99036
title: 'dm: fix reading free memory in do_resume'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm: fix reading free memory in do_resume

  When do_resume calls dm_table_get_mode(new_map), the call is done without
  holding any locks (it only holds a reference to the …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    281f68d6cf8acb2547ebf0a849b8beae8fb0ec3c
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    2c96d1a8324e7736e0f8a5790ecf39d36c2c4a82
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    e3bf232c913b7e0103d323f15e6342d37cb1b357
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    301691c32b8ad023e3316d5dbb6a8cf52d47b0dc
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    c9417c1c5269e2bd0570fbe53e4ec03a8d31f008
  - Linux < 6.6.160
  - Linux < 6.12.113
  - Linux < 6.18.57
  - Linux < 7.2.11
  - Linux (all versions)
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:21:49.410Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99036'
references:
  - url: 'https://git.kernel.org/stable/c/281f68d6cf8acb2547ebf0a849b8beae8fb0ec3c'
  - url: 'https://git.kernel.org/stable/c/2c96d1a8324e7736e0f8a5790ecf39d36c2c4a82'
  - url: 'https://git.kernel.org/stable/c/e3bf232c913b7e0103d323f15e6342d37cb1b357'
  - url: 'https://git.kernel.org/stable/c/301691c32b8ad023e3316d5dbb6a8cf52d47b0dc'
  - url: 'https://git.kernel.org/stable/c/c9417c1c5269e2bd0570fbe53e4ec03a8d31f008'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.529Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm: fix reading free memory in do_resume

When do_resume calls dm_table_get_mode(new_map), the call is done without
holding any locks (it only holds a reference to the md). It may be
possible that another concurrent ioctl on the same device will swap table
after dm_swap_table and before dm_table_get_mode. In this case,
dm_table_get_mode(new_map) reads freed memory.

This race condition was triggered by syzbot.

This commit fixes the race by reading mode of the new table before
dm_swap_table. Note that new_map is also passed to dm_ima_need_measure,
but this function doesn't attempt to dereference it, so this call should
be safe.

Note that this is not a security bug because only root can trigger it and
the commonly used tools such as lvm or cryptsetup do not call the ioctls
concurrently, so that they can't trigger it acceidentally.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 281f68d6cf8acb2547ebf0a849b8beae8fb0ec3c`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2c96d1a8324e7736e0f8a5790ecf39d36c2c4a82`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e3bf232c913b7e0103d323f15e6342d37cb1b357`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 301691c32b8ad023e3316d5dbb6a8cf52d47b0dc`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c9417c1c5269e2bd0570fbe53e4ec03a8d31f008`
- `Linux < 6.6.160`
- `Linux < 6.12.113`
- `Linux < 6.18.57`
- `Linux < 7.2.11`
- `Linux (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.