CVE-2026-99036

In the Linux kernel, the following vulnerability has been resolved:

dm: fix reading free memory in do resume

When do resume calls dm table get mode(new map), the call is done without holding any locks (it only holds a reference to the md). It may be possible that another concurrent ioctl on the same device will swap table after dm swap table and before dm table get mode. In this case, dm table get mode(new map) reads freed memory.

This race condition was triggered by syzbot.

This commit fixes the race by reading mode of the new table before dm swap table. Note that new map is also passed to dm ima need measure, but this function doesn't attempt to dereference it, so this call should be safe.

Note that this is not a security bug because only root can trigger it and the commonly used tools such as lvm or cryptsetup do not call the ioctls concurrently, so that they can't trigger it acceidentally.