# CVE-2026-89576

## Summary

- **CVE ID:** CVE-2026-89576
- **Severity:** UNKNOWN
- **CVSS Score:** 0
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 16, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

dm-era: fix shadowed superblock leak on take-snap failure

metadata_take_snap() bumps the live superblock refcount and then
dm_tm_shadow_block() allocates a new block for the metadata snapshot.
If the subsequent dm_sm_inc_block() of writeset_tree_root or
era_array_root fails, the function only unlocks the clone and
returns.  The newly allocated shadow block is never returned to the
metadata space map, so each failed take-snap permanently leaks one
metadata block.

Free the clone with dm_sm_dec_block() on those error paths, matching
the final step of metadata_drop_snap().

## Affected Products

- Linux — Linux (eec40579d84873dfb7021eb24c50360f073237c5)
- Linux — Linux (3.15)
- Linux — Linux (0)
- Linux — Linux (6.12.109)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)
- Linux — Linux (5.10.270)
- Linux — Linux (5.15.221)
- Linux — Linux (6.1.188)
- Linux — Linux (6.6.157)

## References

- [CNA](https://git.kernel.org/stable/c/d66ceeefb87ddb097b0546bafc581380b816b048)
- [CNA](https://git.kernel.org/stable/c/36ff918637e3517f732188a3c39dbeae5b9cfb1b)
- [CNA](https://git.kernel.org/stable/c/6876ca330e741fb8886d12070cb6a7f9cb67257e)
- [CNA](https://git.kernel.org/stable/c/39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713)
- [CNA](https://git.kernel.org/stable/c/54dd21ca945ecc07885012b9f3e8197f091cfba0)
- [CNA](https://git.kernel.org/stable/c/ef00efb6fcaee88f50891279ceced17c614e97f7)
- [CNA](https://git.kernel.org/stable/c/e9fa68b89214bc65af0ef963af7ec3cce9f866e0)
- [CNA](https://git.kernel.org/stable/c/dc731d7fddfd6149f5e88ea080475d18c36d3c64)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.21%
- **EPSS Percentile:** 11.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-19._