All vulnerabilities
CVE-2026-99136

Linux: dm-crypt: fix a tiny race condition in crypt_dec_pending

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in4f16bb982b27b9f5a15301f622c318001fe521f8Also 148845aa1921d95ef5dc851c76e6a284f6657df6, 2.6.29CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 4f16bb982b27b9f5a15301f622c318001fe521f8LinuxCVE List
  • 148845aa1921d95ef5dc851c76e6a284f6657df6LinuxCVE List
  • 2.6.29LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

dm-crypt: fix a tiny race condition in crypt_dec_pending

crypt_dec_pending reads io->error before calling atomic_dec_and_test. Another context, for example crypt_endio called from an interrupt, may set io->error and drop its reference between the read and the decrement. crypt_dec_pending then drops the last reference and completes the bio with the stale status - so a read that failed and was never decrypted, or a write that failed, is reported as successful.

The read was placed before the decrement by commit b35f8caa0890 ("dm crypt: wait for endio to complete before destruction"), because that commit freed dm_crypt_io before calling bio_endio. This is no longer the case, dm_crypt_io lives in the per-bio data now.

Read io->error after atomic_dec_and_test instead. atomic_dec_and_test is fully ordered, so no additional barrier is needed.

Text from CVE List

Affected versions 10

  • Linuxaffected: b35f8caa0890169000fec22902290d9a15274cbd before ac5d887ab93592fc5e3605fe30c1d8d232d609b3CVE List
  • Linuxaffected: b35f8caa0890169000fec22902290d9a15274cbd before 4f16bb982b27b9f5a15301f622c318001fe521f8CVE List
  • Linuxaffected: b35f8caa0890169000fec22902290d9a15274cbd before 148845aa1921d95ef5dc851c76e6a284f6657df6CVE List
  • Linuxaffected: 9c8f3fcd3ffd3283cc0971c8919058356f20a963CVE List
  • Linuxaffected: 2.6.28.9 before 2.6.29CVE List
  • Linuxaffected: 2.6.29CVE List
  • Linuxunaffected: all versions before 2.6.29CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3