In the Linux kernel, the following vulnerability has been resolved:
dm: fix race when loading and unloading a table
If the userspace calls two concurrent table load ioctls and one of them
succeeds and the other fails, there is a race condition because
dm_setup_md_queue walks &md->table_devices without any lock. If the walk
races with dm_table_destroy -> free_devices -> dm_put_table_device, there
is access to invalid memory.
Fix this race by extending the lock over the list walk.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The race is reached only through local DM_TABLE_LOAD ioctls on /dev/mapper/control (ctl_ioctl → table_load → dm_setup_md_queue walking md->table_devices). No network, Bluetooth, or physical-bus path loads a device-mapper table.
AC:L - The attacker issues two concurrent table-load ioctls on a mapped device they created, owning both sides of the race: one load fails after populate_table added devices and dm_table_destroy frees them while the other walks the list. Device-mapper is a standard distro component, not a rare config.
PR:L - ctl_ioctl requires capable(CAP_SYS_ADMIN). In the most severe reasonable deployment that capability is held by a container, CSI, or LVM/storage-stack administrator with delegated /dev/mapper/control rather than exclusive host root, matching kernel-CNA scoring of other device-mapper ioctl bugs as Low.
UI:N - The attacker performs every step with its own ioctls (DM_DEV_CREATE then concurrent DM_TABLE_LOAD). No separate victim action such as mounting a filesystem or opening a file is required.
S:U - The use-after-free of struct table_device stays inside the host kernel's security authority. This is standard kernel memory corruption, not a VM, IOMMU, or sandbox boundary crossing.
C:H - dm_setup_md_queue walks md->table_devices and dereferences td->dm_dev.bdev after a concurrent dm_table_destroy has kfree'd the table_device. Reclaiming that slab object yields an arbitrary kernel read, so confidentiality is High.
I:H - The same use-after-free lets an attacker spray a replacement object so bd_link_disk_holder writes through an attacker-controlled bdev pointer, a classic heap UAF write and control-flow hijack primitive, so integrity is High.
A:H - Walking a freed table_device list entry or calling bd_link_disk_holder on a dangling bdev causes a kernel oops, panic, or hang, which is a complete availability impact.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The race is reached only through local DM_TABLE_LOAD ioctls on /dev/mapper/control (ctl_ioctl → table_load → dm_setup_md_queue walking md->table_devices). No network, Bluetooth, or physical-bus path loads a device-mapper table.
AC:L - The attacker issues two concurrent table-load ioctls on a mapped device they created, owning both sides of the race: one load fails after populate_table added devices and dm_table_destroy frees them while the other walks the list. Device-mapper is a standard distro component, not a rare config.
PR:L - ctl_ioctl requires capable(CAP_SYS_ADMIN). In the most severe reasonable deployment that capability is held by a container, CSI, or LVM/storage-stack administrator with delegated /dev/mapper/control rather than exclusive host root, matching kernel-CNA scoring of other device-mapper ioctl bugs as Low.
UI:N - The attacker performs every step with its own ioctls (DM_DEV_CREATE then concurrent DM_TABLE_LOAD). No separate victim action such as mounting a filesystem or opening a file is required.
S:U - The use-after-free of struct table_device stays inside the host kernel's security authority. This is standard kernel memory corruption, not a VM, IOMMU, or sandbox boundary crossing.
C:H - dm_setup_md_queue walks md->table_devices and dereferences td->dm_dev.bdev after a concurrent dm_table_destroy has kfree'd the table_device. Reclaiming that slab object yields an arbitrary kernel read, so confidentiality is High.
I:H - The same use-after-free lets an attacker spray a replacement object so bd_link_disk_holder writes through an attacker-controlled bdev pointer, a classic heap UAF write and control-flow hijack primitive, so integrity is High.
A:H - Walking a freed table_device list entry or calling bd_link_disk_holder on a dangling bdev causes a kernel oops, panic, or hang, which is a complete availability impact.
CVSS 3.1