CVE-2026-72102

CVE-2026-72102 is a use-after-free in the device-mapper subsystem stemming from an implicit ownership transfer in the dm_swap_table API that most developers never expect. When dm_swap_table succeeds, the table passed to it is no longer owned by the caller — ownership transfers to the mapped device's resume machinery. This transfer is not documented in the API contract. The bug occurred because the error handler in dm_early_create called dm_table_destroy on a table it no longer owned, after dm_swap_table had already taken possession. The patch simply removes that erroneous destroy call, which fixes the crash but leaves the implicit ownership transfer intact. Be aware that this creates a new failure mode: if dm_resume fails after ownership transfer, the table now leaks rather than being double-freed. Under memory pressure or rapid device creation/destruction cycles, this leak becomes a denial-of-service vector that may be harder to detect than a crash. The deeper risk is structural — the API's real semantics diverge from what developers reasonably expect, and this pattern of implicit ownership transfer has caused similar bugs in VFS superblock lifecycle and the driver model. Audit any other code paths that call dm_swap_table or dm_early_create for similar error-handling assumptions. The fix is correct for this instance, but it does not prevent the next developer from hitting the same trap when they encounter dm_swap_table in isolation. The knowledge that ownership transfers lives in commit history, not in type system guarantees or API documentation — treat it as a one-off until the subsystem formalizes object lifecycle ownership in its contracts.

Reviewed through automated stages and approved by a human before publication.