{"id":"CVE-2026-89576","revision":"8aa71e7b1b6f4ddfa71ec536b152429f","records":[{"revision":"8aa71e7b1b6f4ddfa71ec536b152429f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89576","aliases":[],"title":"dm-era: fix shadowed superblock leak on take-snap failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-era: fix shadowed superblock leak on take-snap failure\n\nmetadata_take_snap() bumps the live superblock refcount and then\ndm_tm_shadow_block() allocates a new block for the metadata snapshot.\nIf the subsequent dm_sm_inc_block() of writeset_tree_root or\nera_array_root fails, the function only unlocks the clone and\nreturns.  The newly allocated shadow block is never returned to the\nmetadata space map, so each failed take-snap permanently leaks one\nmetadata block.\n\nFree the clone with dm_sm_dec_block() on those error paths, matching\nthe final step of metadata_drop_snap().","state":0,"publishedAt":"2026-09-11T19:44:43.777+00:00","modifiedAt":"2026-10-19T08:49:09.363+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-era-target.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"54dd21ca945ecc07885012b9f3e8197f091cfba0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"ef00efb6fcaee88f50891279ceced17c614e97f7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"e9fa68b89214bc65af0ef963af7ec3cce9f866e0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"dc731d7fddfd6149f5e88ea080475d18c36d3c64\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"d66ceeefb87ddb097b0546bafc581380b816b048\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"36ff918637e3517f732188a3c39dbeae5b9cfb1b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"6876ca330e741fb8886d12070cb6a7f9cb67257e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eec40579d84873dfb7021eb24c50360f073237c5\",\n                            \"lessThan\": \"39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-era-target.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/54dd21ca945ecc07885012b9f3e8197f091cfba0","https://git.kernel.org/stable/c/ef00efb6fcaee88f50891279ceced17c614e97f7","https://git.kernel.org/stable/c/e9fa68b89214bc65af0ef963af7ec3cce9f866e0","https://git.kernel.org/stable/c/dc731d7fddfd6149f5e88ea080475d18c36d3c64","https://git.kernel.org/stable/c/d66ceeefb87ddb097b0546bafc581380b816b048","https://git.kernel.org/stable/c/36ff918637e3517f732188a3c39dbeae5b9cfb1b","https://git.kernel.org/stable/c/6876ca330e741fb8886d12070cb6a7f9cb67257e","https://git.kernel.org/stable/c/39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89576","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89576","identifiers":["CVE-2026-89576"]},"retained":false,"historicalAffected":[]}],"coverage":[]}