In the Linux kernel, the following vulnerability has been resolved:
dm: fix resume-vs-remove race
If the user issues the resume ioctl and the remove ioctl at the same
time, it may be possible that the device is resumed after it is suspended
in __dm_destroy. The result is that the table is destroyed without
calling the postsuspend method.
Dm targets expect that they may be removed only after the postsuspend
method method was called. If we break this expectation, it can cause
misbehavior in various targets. For example - in the dm-integrity target,
the reboot notifier is not unregistered, leading to use-after-free.
Fix this bug by refusing to resume if the device is being destroyed.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The bug is reached only through local device-mapper ioctls on /dev/mapper/control (ctl_ioctl → DM_DEV_SUSPEND resume and DM_DEV_REMOVE → dm_resume racing __dm_destroy). No network, Bluetooth, or physical-bus path feeds this race.
AC:L - The attacker issues concurrent resume and remove ioctls on a mapped device they control, owning both sides of the race. __dm_destroy waits for holders while resume already holds a reference, so the window is reliably hit without victim state or an uncontrolled memory layout.
PR:L - ctl_ioctl requires capable(CAP_SYS_ADMIN). In the most severe reasonable deployment that capability is held by a container, CSI, or LVM/storage-stack administrator with delegated /dev/mapper/control rather than exclusive host root, matching kernel-CNA scoring of other device-mapper ioctl bugs as Low.
UI:N - The attacker performs every step with its own ioctls (create and optionally suspend the mapped device, then concurrent resume and remove). No separate victim action such as mounting a filesystem or opening a file is required.
S:U - The use-after-free and resulting kernel corruption stay inside the host kernel's security authority. This is standard kernel memory corruption, not a VM, IOMMU, or sandbox boundary crossing.
C:H - Skipping postsuspend after resume leaves target objects live after dtr frees them, including the dm-integrity reboot notifier and the dm-snapshot origin list. That use-after-free lets an attacker reclaim the object and obtain an arbitrary kernel read.
I:H - The same use-after-free (global origin-list entry, reboot notifier, and restarted dm-thin/dm-cache work) is kernel memory corruption that can be turned into an arbitrary write and control-flow hijack, not merely on-disk integrity loss.
A:H - Use-after-free of target private data, list corruption on _dm_origins, and BUG_ON in dm_integrity_dtr when I/O remains in-progress cause a kernel oops, panic, or hang.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The bug is reached only through local device-mapper ioctls on /dev/mapper/control (ctl_ioctl → DM_DEV_SUSPEND resume and DM_DEV_REMOVE → dm_resume racing __dm_destroy). No network, Bluetooth, or physical-bus path feeds this race.
AC:L - The attacker issues concurrent resume and remove ioctls on a mapped device they control, owning both sides of the race. __dm_destroy waits for holders while resume already holds a reference, so the window is reliably hit without victim state or an uncontrolled memory layout.
PR:L - ctl_ioctl requires capable(CAP_SYS_ADMIN). In the most severe reasonable deployment that capability is held by a container, CSI, or LVM/storage-stack administrator with delegated /dev/mapper/control rather than exclusive host root, matching kernel-CNA scoring of other device-mapper ioctl bugs as Low.
UI:N - The attacker performs every step with its own ioctls (create and optionally suspend the mapped device, then concurrent resume and remove). No separate victim action such as mounting a filesystem or opening a file is required.
S:U - The use-after-free and resulting kernel corruption stay inside the host kernel's security authority. This is standard kernel memory corruption, not a VM, IOMMU, or sandbox boundary crossing.
C:H - Skipping postsuspend after resume leaves target objects live after dtr frees them, including the dm-integrity reboot notifier and the dm-snapshot origin list. That use-after-free lets an attacker reclaim the object and obtain an arbitrary kernel read.
I:H - The same use-after-free (global origin-list entry, reboot notifier, and restarted dm-thin/dm-cache work) is kernel memory corruption that can be turned into an arbitrary write and control-flow hijack, not merely on-disk integrity loss.
A:H - Use-after-free of target private data, list corruption on _dm_origins, and BUG_ON in dm_integrity_dtr when I/O remains in-progress cause a kernel oops, panic, or hang.
CVSS 3.1