CVE-2026-99256

In the Linux kernel, the following vulnerability has been resolved:

dm cache: fix issue with background work locking

dm cache used a rw semaphore for background work lock. Write locks on rw semaphores have strict owner semantics, but there was no guarantee that the process that locked background work lock was the same process that unlocked it. This can be easily seen using a kernel compiled with CONFIG DEBUG RWSEMS. Given a dm cache device , run: 'dmsetup suspend && dmsetup resume '. This will trigger a kernel warning:

DEBUG RWSEMS WARN ON((rwsem owner(sem) != current) && !rwsem test oflags(sem, RWSEM NONSPINNABLE))

triggered by cache resume(). To fix this, switch from a rw semaphore to a spinlock and a wait queue. dm cache already has a wait queue and associated counter, migration wait and nr allocated migrations, that was getting woken up when background work was getting completed, but wasn't actually used by anything. This is replaced by the background work queue and counter.