CVE-2026-99256: 
Linux Kernel 취약점 분석 및 완화

CVE-2026-99256 is a locking semantics flaw in the Linux kernel's dm cache subsystem, specifically in the handling of background_work_lock. The vulnerability arises because a rw_semaphore write lock was used without guaranteeing that the same process that acquired the lock would release it, violating strict owner semantics enforced by CONFIG_DEBUG_RWSEMS. It affects the Linux kernel from version 4.12 onward, across multiple stable branches up to 7.2.x. The vulnerability was published on November 3, 2026, and carries a CVSS v3.1 base score of 2.3 (Low) (GitHub Advisory, Microsoft MSRC).

The root cause is improper synchronization (CWE-667: Improper Locking) in the dm cache driver's use of rw_semaphore for background_work_lock. Write locks on rw_semaphore have strict owner semantics in the Linux kernel — the process that acquires the lock must be the same one that releases it — but the dm cache code did not enforce this, allowing a different process to release the lock during cache_resume(). This can be triggered locally by a privileged user running dmsetup suspend <cache> && dmsetup resume <cache>, which causes a kernel warning: DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)). The fix replaces the rw_semaphore with a spinlock and a dedicated wait queue, reusing and replacing the existing migration_wait/nr_allocated_migrations mechanism (GitHub Advisory).

Exploitation of this vulnerability by a local user with administrative privileges (capable of issuing dmsetup commands) can trigger kernel warnings and potentially cause undefined kernel behavior or a system crash, resulting in a denial-of-service condition. There is no impact on confidentiality or integrity; the availability impact is rated Low given that a crash requires deliberate triggering by a privileged local user. Lateral movement or data exposure are not associated with this vulnerability (Microsoft MSRC, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.202%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and high privileges (ability to run dmsetup commands), significantly limiting the attack surface (GitHub Advisory, Microsoft MSRC).

Patches are available across multiple stable Linux kernel branches. Fixed versions include 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13, and 7.3 (mainline). Administrators should update to a patched kernel version as the primary remediation. As a temporary workaround, restrict administrative access to dmsetup commands and dm cache device operations to trusted users only, and monitor for kernel warnings related to rwsem ownership violations on affected systems (GitHub Advisory, Microsoft MSRC).