Answer in brief
CVE-2026-89576 records a Unknown severity vulnerability in dm-era: fix shadowed superblock leak on take-snap failure. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=eec40579d84873dfb7021eb24c50360f073237c5 <d66ceeefb87ddb097b0546bafc581380b816b048 || >=eec40579d84873dfb7021eb24c50360f073237c5 <36ff918637e3517f732188a3c39dbeae5b9cfb1b || >=eec40579d84873dfb7021eb24c50360f073237c5 <6876ca330e741fb8886d12070cb6a7f9cb67257e || >=eec40579d84873dfb7021eb24c50360f073237c5 <39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713 | d66ceeefb87ddb097b0546bafc581380b816b048, 36ff918637e3517f732188a3c39dbeae5b9cfb1b, 6876ca330e741fb8886d12070cb6a7f9cb67257e, 39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713 |
| Linux/Linuxgeneric | 3.15 | Not reported |
| Linux/Linuxgeneric | >=eec40579d84873dfb7021eb24c50360f073237c5 <54dd21ca945ecc07885012b9f3e8197f091cfba0 || >=eec40579d84873dfb7021eb24c50360f073237c5 <ef00efb6fcaee88f50891279ceced17c614e97f7 || >=eec40579d84873dfb7021eb24c50360f073237c5 <e9fa68b89214bc65af0ef963af7ec3cce9f866e0 || >=eec40579d84873dfb7021eb24c50360f073237c5 <dc731d7fddfd6149f5e88ea080475d18c36d3c64 || >=eec40579d84873dfb7021eb24c50360f073237c5 <d66ceeefb87ddb097b0546bafc581380b816b048 || >=eec40579d84873dfb7021eb24c50360f073237c5 <36ff918637e3517f732188a3c39dbeae5b9cfb1b || >=eec40579d84873dfb7021eb24c50360f073237c5 <6876ca330e741fb8886d12070cb6a7f9cb67257e || >=eec40579d84873dfb7021eb24c50360f073237c5 <39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713 | 54dd21ca945ecc07885012b9f3e8197f091cfba0, ef00efb6fcaee88f50891279ceced17c614e97f7, e9fa68b89214bc65af0ef963af7ec3cce9f866e0, dc731d7fddfd6149f5e88ea080475d18c36d3c64, d66ceeefb87ddb097b0546bafc581380b816b048, 36ff918637e3517f732188a3c39dbeae5b9cfb1b, 6876ca330e741fb8886d12070cb6a7f9cb67257e, 39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap() bumps the live superblock refcount and then dm_tm_shadow_block() allocates a new block for the metadata snapshot. If the subsequent dm_sm_inc_block() of writeset_tree_root or era_array_root fails, the function only unlocks the clone and returns. The newly allocated shadow block is never returned to the metadata space map, so each failed take-snap permanently leaks one metadata block. Free the clone with dm_sm_dec_block() on those error paths, matching the final step of metadata_drop_snap().
Quoted source text, attributed separately from HOL analysis.