{"cve":"CVE-2026-53063","nvd":{"published":"2026-06-24T17:17:19.173","modified":"2026-07-21T17:36:23.310","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix write hang in passthrough mode\n\nThe invalidate_remove() function has incomplete logic for handling write\nhit bios after cache invalidation. It sets up the remapping for the\noverwrite_bio but then drops it immediately without submission, causing\nwrite operations to hang.\n\nFix by adding a new invalidate_committed() continuation that submits\nthe remapped writes to the cache origin after metadata commit completes,\nwhile using the overwrite_endio hook to ensure proper completion\nsequencing. This maintains existing coherency. Also improve error\nhandling in invalidate_complete() to preserve the original error status\ninstead of using bio_io_error() unconditionally.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/05798d091ebcfb6d68228890e593f209e8ac940d","https://git.kernel.org/stable/c/4ca8b8bd952df7c3ccdc68af9bd3419d0839a04b","https://git.kernel.org/stable/c/64d6519b00be4116d365bd31f33a5e5ce2944c1a","https://git.kernel.org/stable/c/9fa18d0b981776b190ca4632942a7c2174052b78","https://git.kernel.org/stable/c/b8ace9e96983abb20ccf39edce8a60f1bb0b83d8"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:41:17.107060303+00:00"},"epss":{"cve":"CVE-2026-53063","score":0.00128,"percentile":0.02429,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}