# CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching - **Severity:** Medium 5.5 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`) - **Exploited in the wild:** Not known - **Fix available:** Yes - **Published:** 24 Jun 2026 - **Updated:** 24 Jun 2026 - **Also known as:** BELL-CVE-2026-53061, DEBIAN-CVE-2026-53061, GHSA-h3w6-62jw-v8p3, ROOT-OS-DEBIAN-11-CVE-2026-53061, ROOT-OS-DEBIAN-12-CVE-2026-53061, ROOT-OS-UBUNTU-2204-CVE-2026-53061, ROOT-OS-UBUNTU-2404-CVE-2026-53061, UBUNTU-CVE-2026-53061 ## What is CVE-2026-53061? CVE-2026-53061 is a medium-severity vulnerability in Linux kernel, published on 24 Jun 2026. ### Official description In the Linux kernel, the following vulnerability has been resolved: dm cache: fix dirty mapping checking in passthrough mode switching As mentioned in commit 9b1cc9f251af ("dm cache: share cache-metadata object across inactive and active DM tables"), dm-cache assumed table reload occurs after suspension, while LVM's table preload breaks this assumption. The dirty mapping check for passthrough mode was designed around this assumption and is performed during table creation, causing the check to fail with preload while metadata updates are ongoing. This risks loading dirty mappings into passthrough mode, resulting in data loss. Reproduce steps: 1. Create a writeback cache with zero migration_threshold to produce dirty mappings dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writeback smq \ 2 migration_threshold 0" 2. Preload a table in passthrough mode dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" 3. Write to the first cache block to make it dirty fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \ --direct=1 --size=64k 4. Resume the inactive table. Now it's possible to load the dirty block into passthrough mode. dmsetup resume cache Fix by moving the checks to the preresume phase to support table preloading. Also remove the unused function dm_cache_metadata_all_clean. ## Which versions are affected by CVE-2026-53061? It affects 1 product. Products: Linux kernel. ## How do I fix CVE-2026-53061? Upgrade to a fixed version. ## Is CVE-2026-53061 being exploited? There is no known exploitation of CVE-2026-53061 in the wild and no public exploit code. ## Other vulnerabilities in Linux kernel - [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild) - [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild) - [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild) - [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild) - [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-53061 and fix it if it is affected. What it is: CVE-2026-53061 is a medium-severity vulnerability in Linux kernel, published on 24 Jun 2026. Exploitation: There is no known exploitation of CVE-2026-53061 in the wild and no public exploit code. Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-53061/ (Markdown: https://insights.sbomify.com/CVE-2026-53061/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-53061 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53061 - OSV: https://osv.dev/vulnerability/CVE-2026-53061 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-53061/ Summaries are generated and may contain mistakes; the official description above is the record.