Medium 5.5Published Jun 24, 2026

CVE-2026-53063dm cache: fix write hang in passthrough mode

Updated under an hour ago (Oct 28, 2026, 4:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix write hang in passthrough mode The invalidate_remove() function has incomplete logic for handling write hit bios after cache invalidation. It sets up the remapping for the overwrite_bio but then drops it immediately without submission, causing write operations to hang. Fix by adding a new invalidate_committed() continuation that submits the remapped writes to the cache origin after metadata commit completes, while using the overwrite_endio hook to ensure proper completion sequencing. This maintains existing coherency. Also improve error handling in invalidate_complete() to preserve the original error status instead of using bio_io_error() unconditionally.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b29d4986d0da1a27cd35917cdb433672f5c95d7f before 9fa18d0b981776b190ca4632942a7c2174052b78; from b29d4986d0da1a27cd35917cdb433672f5c95d7f before ecb10c193cbebf5e6984246a9b4ff1f95d45ed87; from b29d4986d0da1a27cd35917cdb433672f5c95d7f before 64d6519b00be4116d365bd31f33a5e5ce2944c1a; from b29d4986d0da1a27cd35917cdb433672f5c95d7f before b8ace9e96983abb20ccf39edce8a60f1bb0b83d8; from b29d4986d0da1a27cd35917cdb433672f5c95d7f before 05798d091ebcfb6d68228890e593f209e8ac940d; from b29d4986d0da1a27cd35917cdb433672f5c95d7f before 4ca8b8bd952df7c3ccdc68af9bd3419d0839a04b	CNA record
linux linux_kernel linux:linux_kernel	from 4.12 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/9fa18d0b981776b190ca4632942a7c2174052b78	patch
https://git.kernel.org/stable/c/ecb10c193cbebf5e6984246a9b4ff1f95d45ed87	patch
https://git.kernel.org/stable/c/64d6519b00be4116d365bd31f33a5e5ce2944c1a	patch
https://git.kernel.org/stable/c/b8ace9e96983abb20ccf39edce8a60f1bb0b83d8	patch
https://git.kernel.org/stable/c/05798d091ebcfb6d68228890e593f209e8ac940d	patch
https://git.kernel.org/stable/c/4ca8b8bd952df7c3ccdc68af9bd3419d0839a04b	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.