{"apiVersion":"1.0","identifier":"CVE-2026-99036","description":"In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do_resume When do_resume calls dm_table_get_mode(new_map), the call is done without holding any locks (it only holds a reference to the md). It may be possible that another concurrent ioctl on the same device will swap table after dm_swap_table and before dm_table_get_mode. In this case, dm_table_get_mode(new_map) reads freed memory. This race condition was triggered by syzbot. This commit fixes the race by reading mode of the new table before dm_swap_table. Note that new_map is also passed to dm_ima_need_measure, but this function doesn-t attempt to dereference it, so this call should be safe. Note that this is not a security bug because only root can trigger it and the commonly used tools such as lvm or cryptsetup do not call the ioctls concurrently, so that they can-t trigger it acceidentally.","publishedAt":"2026-10-23T13:17:26","lastModifiedAt":"2026-10-30T13:21:40","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99036","cvssScore":null,"cvssVector":null,"epssProbability":0.0022,"riskScore":null,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99036","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99036","en":"https://www.redsauce.net/en/cves/CVE-2026-99036","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99036","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99036","de":"https://www.redsauce.net/de/cves/CVE-2026-99036","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99036","el":"https://www.redsauce.net/el/cves/CVE-2026-99036"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99036"}}