CVE-2026-89576

In the Linux kernel, the following vulnerability has been resolved:

dm-era: fix shadowed superblock leak on take-snap failure

metadata take snap() bumps the live superblock refcount and then dm tm shadow block() allocates a new block for the metadata snapshot. If the subsequent dm sm inc block() of writeset tree root or era array root fails, the function only unlocks the clone and returns. The newly allocated shadow block is never returned to the metadata space map, so each failed take-snap permanently leaks one metadata block.

Free the clone with dm sm dec block() on those error paths, matching the final step of metadata drop snap().