All vulnerabilities
CVE-2026-99037

Linux: dm-crypt: reject the lmk IV mode with AEAD ciphers

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in9a0dab8a9d9975dec14a118b55cae2517aea5ca9Also 962ce265fbf5d87afeb78cf19c12e083ab0ffeb8, 40ea7dfa8cd5f9aed72a55c9ca3008aee5880e6f and 1 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 9a0dab8a9d9975dec14a118b55cae2517aea5ca9LinuxCVE List
  • 962ce265fbf5d87afeb78cf19c12e083ab0ffeb8LinuxCVE List
  • 40ea7dfa8cd5f9aed72a55c9ca3008aee5880e6fLinuxCVE List
  • 3195e0daf590683992edb4eed32269e569e04924LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

dm-crypt: reject the lmk IV mode with AEAD ciphers

A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcm(aes)-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets tfms_count to 64, but crypt_alloc_tfms_aead only allocates one transform, so crypt_setkey reads past the end of the tfms_aead array and calls crypto_aead_setkey on the values it finds there.

lmk exists for compatibility with Loop-AES, which uses CBC, so refuse it with an AEAD cipher rather than allocate 64 AEAD transforms. The check cannot go in crypt_iv_lmk_ctr with the other lmk checks, because the IV constructor runs after crypt_set_key.

Note that this is not a security bug because the memory corruption can only be triggered by root.

Text from CVE List

Affected versions 12

  • Linuxaffected: 33d2f09fcb357fd1861c4959d1d3505492bf91f8 before 9a0dab8a9d9975dec14a118b55cae2517aea5ca9CVE List
  • Linuxaffected: 33d2f09fcb357fd1861c4959d1d3505492bf91f8 before 962ce265fbf5d87afeb78cf19c12e083ab0ffeb8CVE List
  • Linuxaffected: 33d2f09fcb357fd1861c4959d1d3505492bf91f8 before a1a875614dae43b43d311bb9e7a7a70eed78efe6CVE List
  • Linuxaffected: 33d2f09fcb357fd1861c4959d1d3505492bf91f8 before 40ea7dfa8cd5f9aed72a55c9ca3008aee5880e6fCVE List
  • Linuxaffected: 33d2f09fcb357fd1861c4959d1d3505492bf91f8 before 3195e0daf590683992edb4eed32269e569e04924CVE List
  • Linuxaffected: 4.12CVE List
  • Linuxunaffected: all versions before 4.12CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5