CVE-2026-53265

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> dm cache policy smq: check allocation under invalidate lock<br /> <br /> commit 2d1f7b65f5de ("dm cache policy smq: fix missing locks in<br /> invalidating cache blocks") added mq-&gt;lock around the destructive part of<br /> smq_invalidate_mapping(), but left the e-&gt;allocated check outside the<br /> critical section.<br /> <br /> That leaves a check-then-act race. Two concurrent invalidators can both<br /> observe e-&gt;allocated as true before either of them takes mq-&gt;lock. The<br /> first invalidator that acquires the lock removes the entry from the<br /> queues and hash table and then calls free_entry(), which clears<br /> e-&gt;allocated and puts the entry back on the free list. The second<br /> invalidator can then acquire mq-&gt;lock and continue with the stale result<br /> of the unlocked check.<br /> <br /> This can corrupt the SMQ queues or hash table by deleting an entry that<br /> is no longer on those structures. It can also hit the allocation check in<br /> free_entry() when the same entry is freed again.<br /> <br /> Move the allocation check under mq-&gt;lock so the predicate and the<br /> destructive operations are serialized by the same lock.