CVE-2026-89576 dm-era: fix shadowed superblock leak on take-snap failure
A resource leak in the Linux kernel dm-era driver allows local attackers to exhaust metadata space, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89576?
CVE-2026-89576 is a denial of service vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dm-era: fix shadowed superblock leak on take-snap failure
metadata_take_snap() bumps the live superblock refcount and then dm_tm_shadow_block() allocates a new block for the metadata snapshot. If the subsequent dm_sm_inc_block() of writeset_tree_root or era_array_root fails, the function only unlocks the clone and returns. The newly allocated shadow block is never returned to the metadata space map, so each failed take-snap permanently leaks one metadata block.
Free the clone with dm_sm_dec_block() on those error paths, matching the final step of metadata_drop_snap().
Which versions are affected by CVE-2026-89576?
How do I fix CVE-2026-89576?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89576 being exploited?
There is no known exploitation of CVE-2026-89576 in the wild and no public exploit code.
Sources
Also known as AZL-100892, BELL-CVE-2026-89576, DEBIAN-CVE-2026-89576, GHSA-f7fr-q69f-62x9, UBUNTU-CVE-2026-89576.