CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved:

dm-crypt: fix a tiny race condition in crypt dec pending

crypt dec pending reads io->error before calling atomic dec and test. Another context, for example crypt endio called from an interrupt, may set io->error and drop its reference between the read and the decrement. crypt dec pending then drops the last reference and completes the bio with the stale status - so a read that failed and was never decrypted, or a write that failed, is reported as successful.

The read was placed before the decrement by commit b35f8caa0890 ("dm crypt: wait for endio to complete before destruction"), because that commit freed dm crypt io before calling bio endio. This is no longer the case, dm crypt io lives in the per-bio data now.

Read io->error after atomic dec and test instead. atomic dec and test is fully ordered, so no additional barrier is needed.