All vulnerabilities
CVE-2026-99098

Linux: dm-integrity: fix buffer overflow in inline mode with large tag size

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3c7aad85aeb9e28386672e3a009aa2e61f751b86Also 4f0ee735dc68e3e6c4dd9a666d7f7047163c4165, 764b683a6180fd72c931c13fea98d383506a3475CVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

  • 3c7aad85aeb9e28386672e3a009aa2e61f751b86LinuxCVE List
  • 4f0ee735dc68e3e6c4dd9a666d7f7047163c4165LinuxCVE List
  • 764b683a6180fd72c931c13fea98d383506a3475LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix buffer overflow in inline mode with large tag size

In inline mode, dm_integrity_check and dm_integrity_inline_recheck compute the checksum of each block into an on-stack buffer of HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the first read.

Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integrity_metadata.

Note that this is not a security bug because the buffer overflow can only be triggered by root.

Text from CVE List

Affected versions 10

  • Linuxaffected: fb0987682c629c1d2c476f35f6fde405a5e304a4 before 3c7aad85aeb9e28386672e3a009aa2e61f751b86CVE List
  • Linuxaffected: fb0987682c629c1d2c476f35f6fde405a5e304a4 before 4f0ee735dc68e3e6c4dd9a666d7f7047163c4165CVE List
  • Linuxaffected: fb0987682c629c1d2c476f35f6fde405a5e304a4 before f49cd7820cd0a96f20e1aa2708adb002124e38a7CVE List
  • Linuxaffected: fb0987682c629c1d2c476f35f6fde405a5e304a4 before 764b683a6180fd72c931c13fea98d383506a3475CVE List
  • Linuxaffected: 6.11CVE List
  • Linuxunaffected: all versions before 6.11CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4