Not yet scoredPublished Sep 11, 2026

CVE-2026-89576dm-era: fix shadowed superblock leak on take-snap failure

Updated under an hour ago (Oct 26, 2026, 4:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap() bumps the live superblock refcount and then dm_tm_shadow_block() allocates a new block for the metadata snapshot. If the subsequent dm_sm_inc_block() of writeset_tree_root or era_array_root fails, the function only unlocks the clone and returns. The newly allocated shadow block is never returned to the metadata space map, so each failed take-snap permanently leaks one metadata block. Free the clone with dm_sm_dec_block() on those error paths, matching the final step of metadata_drop_snap().

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from eec40579d84873dfb7021eb24c50360f073237c5 before 54dd21ca945ecc07885012b9f3e8197f091cfba0; from eec40579d84873dfb7021eb24c50360f073237c5 before ef00efb6fcaee88f50891279ceced17c614e97f7; from eec40579d84873dfb7021eb24c50360f073237c5 before e9fa68b89214bc65af0ef963af7ec3cce9f866e0; from eec40579d84873dfb7021eb24c50360f073237c5 before dc731d7fddfd6149f5e88ea080475d18c36d3c64; from eec40579d84873dfb7021eb24c50360f073237c5 before d66ceeefb87ddb097b0546bafc581380b816b048; from eec40579d84873dfb7021eb24c50360f073237c5 before 36ff918637e3517f732188a3c39dbeae5b9cfb1b; from eec40579d84873dfb7021eb24c50360f073237c5 before 6876ca330e741fb8886d12070cb6a7f9cb67257e; from eec40579d84873dfb7021eb24c50360f073237c5 before 39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713	CNA record

References

References

https://git.kernel.org/stable/c/54dd21ca945ecc07885012b9f3e8197f091cfba0
https://git.kernel.org/stable/c/ef00efb6fcaee88f50891279ceced17c614e97f7
https://git.kernel.org/stable/c/e9fa68b89214bc65af0ef963af7ec3cce9f866e0
https://git.kernel.org/stable/c/dc731d7fddfd6149f5e88ea080475d18c36d3c64
https://git.kernel.org/stable/c/d66ceeefb87ddb097b0546bafc581380b816b048
https://git.kernel.org/stable/c/36ff918637e3517f732188a3c39dbeae5b9cfb1b
https://git.kernel.org/stable/c/6876ca330e741fb8886d12070cb6a7f9cb67257e
https://git.kernel.org/stable/c/39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.