All vulnerabilities
CVE-2026-99135

Linux: dm-integrity: fix infinite loop on discard with large tag size

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in251b44b424920df9204e88a81fb3f78fa48ddd99Also 18d80c77b4c7dd20699e81cedfbbff4e9d198f28CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 251b44b424920df9204e88a81fb3f78fa48ddd99LinuxCVE List
  • 18d80c77b4c7dd20699e81cedfbbff4e9d198f28LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix infinite loop on discard with large tag size

When integrity_metadata handles a discard, it fills a buffer with DISCARD_FILLER and writes it over the tags, max_blocks blocks at a time. If the kmalloc fails, the buffer is the on-stack array checksums_onstack and max_size is set to HASH_MAX_DIGESTSIZE. So if the tag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size is never decremented and the loop never terminates.

Fix this by using sizeof(checksums_onstack) as max_size. The array has MAX_TAG_SIZE bytes since commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size"), so max_blocks is at least 1.

Text from CVE List

Affected versions 8

  • Linuxaffected: 84597a44a9d86ac949900441cea7da0af0f2f473 before fc512700f1413fed652dac22fa1c4e837210b9c0CVE List
  • Linuxaffected: 84597a44a9d86ac949900441cea7da0af0f2f473 before 251b44b424920df9204e88a81fb3f78fa48ddd99CVE List
  • Linuxaffected: 84597a44a9d86ac949900441cea7da0af0f2f473 before 18d80c77b4c7dd20699e81cedfbbff4e9d198f28CVE List
  • Linuxaffected: 5.7CVE List
  • Linuxunaffected: all versions before 5.7CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3