All vulnerabilities
CVE-2026-98533

Linux: ipe: protect the dm-verity root hash with RCU

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3bd335ed62444bec61201df7d368a0779e5bd300Also 599d0498a39319285afa908762e0c9fad29f772e, 2776e9c28513a1c855a94792b292cbcc533418c8CVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 3bd335ed62444bec61201df7d368a0779e5bd300LinuxCVE List
  • 599d0498a39319285afa908762e0c9fad29f772eLinuxCVE List
  • 2776e9c28513a1c855a94792b292cbcc533418c8LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipe: protect the dm-verity root hash with RCU

ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes a new one on ->preresume, while policy evaluation can still be dereferencing it.

Protect the root hash with RCU. The evaluation path already runs under rcu_read_lock().

[FW: remove model name according to latest guideline]

Text from CVE List

Affected versions 10

  • Linuxaffected: e155858dd99523d4afe0f74e9c26e4f4499eb5af before 3bd335ed62444bec61201df7d368a0779e5bd300CVE List
  • Linuxaffected: e155858dd99523d4afe0f74e9c26e4f4499eb5af before 599d0498a39319285afa908762e0c9fad29f772eCVE List
  • Linuxaffected: e155858dd99523d4afe0f74e9c26e4f4499eb5af before d7c5bd3159235edb0f2febe2cd3d3b0fb53986f1CVE List
  • Linuxaffected: e155858dd99523d4afe0f74e9c26e4f4499eb5af before 2776e9c28513a1c855a94792b292cbcc533418c8CVE List
  • Linuxaffected: 6.12CVE List
  • Linuxunaffected: all versions before 6.12CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4